seen from Georgia
seen from United Kingdom
seen from Germany
seen from United States
seen from Malaysia
seen from Germany
seen from United States
seen from United States
seen from United States
seen from United States
seen from United States
seen from Germany
seen from Germany
seen from Venezuela
seen from United States
seen from United States
seen from United States
seen from United States
seen from Germany
seen from China
not sure if tumblr will let me post this but here's a project i was working on last week
Contribute to peroxidee/maldev_shellcode_runner development by creating an account on GitHub.
it's a shellcode runner for my malware dev/rev eng/analysis project i teach at my college. it works by writing a section of bytes (the shellcode) to memory, setting a protected execute region, and then making a thread over it. in this harmless case, it makes a window pop up.
been doing research on the unitree go2 so here's a little script i made using the go2 api. need to get my ahdns on the bot again to run and test it bc emulation is bad but neways. it's a shellcode runner, payload generated using msfvenom.
my crack at making a shellcode runner for go2 webrtc
Another shellcode injection technique using C++ that attempts to bypass Windows Defender using XOR encryption sorcery and UUID strings madness :).
To install Medusa, you'll need Mythic installed on a remote computer. You can find installation instructions for Mythic at the Mythic project page.
APT_0x00_0x00
客户端<–>代理服务器<–>防火墙<–>服务器 如果shellcode执行成功就可以直接服务器–》客户端回联的方式与客户端通信
数据通道中两种结构：
ecb（IIS中比较多）[回调函数] ecb->ReadClient ecb->WriteClient
查找socket： getpeername查socket 字串匹配socket
自动版本识别： nmap识别，程序自动进行识别（rpc漏洞调用进行识别操作系统版本）
rpc win2000 15个调用 xp 17 （超出2000） 2.3 20 （超出xp）
同一种语言代码页是相同的加载地址，通过代码验证找一些验证地址 版本之间会不同
PEB中的通用指针
PEB->RtlEnterCriticalSection
Shellcode高级技术【大小写转换， \0截断】
只需要关注she…
View On WordPress
整数溢出
View On WordPress
缓冲区Shellcode_0x03 W32Dasm
漏洞存在原因：wsprintf()函数利用不当
首先通过OD查找所有call，找到wprintf()
我们发现有很多wsprintf出现
在所有调用下断
尝试通过W32Dasm分析一个程序，载入后程序断在wsprintf处
向上分析该处的wprintf，发现是长整型，继续F9
找到%s
进一步查看是否为漏洞出现处，尝试查看edx位置，发现是文件路径
继续向下，发现了复制函数名的位置
edx：buffer的起始位置 00688de4 ebp：buffer的末尾 0068bee0 （相差256字节） 返回地址： 0068BEE4
LordPE查看导入表
这里保存的还是一个偏移量
将该处的LoadLibraryA修改为我们的shellcode
shellcode下方，在返回值…
View On WordPress
缓冲区Shellcode_0x02
查找use32.dll地址
查找fs:[0]指向的是TEB地址，而TEB[30]指向的是PEB
dt _peb 7ffd7000
解析该处的PEB结构
位于PEB中0x0C处的PEB_LDR_DATA结构存放动态链接库信息
解析PEB_LDR_DATA结构体
InInitializeationOrderModuleList中存储的是dll节点信息
dd 0x191f18 dd（Display Dword）
第一个表指针是ntdll表，kernel32是第二个表
通过!peb命令验证我们找到的dll位置
View On WordPress
