Skip to content

Instantly share code, notes, and snippets.

View thatskriptkid's full-sized avatar
🤢
Happy life and happy bytes

Thatskriptkid thatskriptkid

🤢
Happy life and happy bytes
View GitHub Profile
@thatskriptkid
thatskriptkid / loader.go
Created September 1, 2021 05:49
Recreaction of "low detect" cobaltstrike go loader
package main
import (
"syscall"
b64 "encoding/base64"
"unsafe"
)
const (
MEM_COMMIT = 0x00001000
@thatskriptkid
thatskriptkid / Search_kernel32dll_baseaddress.cpp
Last active August 10, 2021 06:21
Search Kernel32dll base address (from MarsStealer malware)
// this is a reproduction of code from [MarsStealer](https://twitter.com/3xp0rtblog/status/1424638227160473602) malware
#include <Windows.h>
#include <stdio.h>
typedef struct _UNICODE_STRING
{
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;