nasbench

Keybase proof

I hereby claim:

• I am nasbench on github.
• I am nasbench (https://keybase.io/nasbench) on keybase.
• I have a public key ASCERZHjJ7mUyROvWgr41hlUXh_byMkTO918VVCAtXhxbgo

To claim this, I am signing this object:

nasbench

using System.Diagnostics;
using Fiddler;

[assembly: Fiddler.RequiredVersion("2.3.5.0")]

namespace POCFiddlerDotNet
{
    public class PersistencePOC : IFiddlerExtension
    {
        public PersistencePOC() { }

nasbench

<ADPlus Version='2'>
    <Settings>
        <Option> FullOnFirst </Option>
        <Runmode> Hang </Runmode>
        <!-- 
            If you want to run the binary and not dump anything. 
            Then this can be any process as long as it's running
        -->
        <ProcessName> notepad.exe </ProcessName> 
        <OutputDir>C:\temp\</OutputDir>

nasbench

as AdpDumpDir C:\logs\20220609_183403_Crash_Mode
.logopen /t "${AdpDumpDir}\ADPlus_log.log"
as AdpOutputDir C:\logs
as AdpDumpDirEsc C:\\logs\\20220609_183403_Crash_Mode
as AdpTimeStamp 20220609_183403
*
*----- OS and Time Information ----
vertarget
*
*

nasbench

Microsoft.NodejsTools.PressAnyKey.exe LOLBIN

This binary can be used as a LOLBIN as described here.

Addtional Info

• The arguments number must be at least 3
• The first first argument can be anything (instead of both, normal or abnormal). Since the switch clause doesn't specify a default case. And the flag variable is set to true before the check.
• The second argument also can be anything and it will be written to the execution path with the contents being the PID of the process File.WriteAllText(args[1], process.Id.ToString());
• The thrid argument is passed directly to ProcessStartInfo and is executed Process.Start(startInfo);. Hence anything can be called

nasbench

DumpMinitool.exe LOLBIN

This binary can be used as a LOLBIN as described here

Addtional Info

• The arguments flags are meaningless only the order is important. This means as long as you provide exactly 6 flags and their value the binary will still work. Here are the exact positions for reference:

// Usage: --file <fullyResolvedPath> --processId <processId> --dumpType <dumpType>

nasbench

Malicious CHM - Proof of Concept

Here are the steps to follow in order to create a malicious CHM file. As used by APT37

• Download the HTML Help Workshop (Htmlhelp.exe) from MSDN. If the link is dead you can use the archive version here
• Once installed you should have a folder C:\Program Files (x86)\HTML Help Workshop and inside the Microsoft HTML Help Compiler (hhc.exe)
• We need to create 3 files:
  • Project File .hpp
  • HTML File .htm
• Table of Contents File .hhc

nasbench

Invoke-CommandInDesktopPackage

You can execute commands in the context of an AppX Package to gain access to it's virtualized resources (example virtualized registry keys or files)

Docs

https://learn.microsoft.com/en-us/powershell/module/appx/invoke-commandindesktoppackage?view=windowsserver2022-ps

Example

nasbench

800, AntiVirus
801, AntiSpyware
802, Antimalware
803, Full
804, Delta
805, Full Scan
806, Quick Scan
807, Custom Scan
808, Remove
809, Quarantine

nasbench

sing System;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
 
 
  
/*
Author: Casey Smith, Twitter: @subTee