reveng007/ETW_patches_from_userMode_learned_till_now

Stars
9
Rank 1,939,727 (Top 39 %)
Language
C++
License
MIT License
Created almost 2 years ago
Updated over 1 year ago

reveng007/ETW_patches_from_userMode_learned_till_now

reveng007

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

ETW patches from userMode learned till now

DarkWidow

Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird + Spawns a sacrificial Process as target process + (ACG+BlockDll) mitigation policy on spawned process + PPID spoofing + Api resolving from TIB + API hashing

SharpGmailC2

Our Friendly Gmail will act as Server and implant will exfiltrate data via smtp and will read commands from C2 (Gmail) via imap protocol

Learning-EDR-and-EDR_Evasion

I will be uploading all the codes which I created with the help either opensource projects or blogs. This is a step by step EDR learning path for me.

reveng_rtkit

Linux Loadable Kernel Module (LKM) based rootkit (ring-0), capable of hiding itself, processes/implants, rmmod proof, has ability to bypass infamous rkhunter antirootkit.

ReflectiveNtdll

A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (using pe2shc by @hasherezade). Payload encryption via SystemFucntion033 NtApi and No new thread via Fiber

CheckHooks-n-load

A Windows stager-cum-PELoader focusing Dynamic EDR Evasion, as well as FUD till now (24/02/23), when Operator wants to Know the the Underlying functions Hooks and then craft Implant based on the previous condition.

AMSI-patches-learned-till-now

I have documented all of the AMSI patches that I learned till now

C2_Server

C2 server to connect to a victim machine via reverse shell

DareDevil

Stealthy Loader-cum-dropper/stage-1/stager targeting Windows10

reveng_loader

C# loader capable of running stage-1 from remote url, file path as well as file share

Executable_Files

Database for custom made as well as publicly available stage-2 or beacons or stageless payloads, used by loaders/stage-1/stagers, or for further usage of C2 as well

GDB-Cheat-Sheet

VulnCon-WorkShop-Slides

VulnCon WorkShop - Maldev Workshop : Offensive TradeCraft - Syscalls to Stack Spoofing

RemoveFalsePositives

Just a small python script which spits out unsigned char representation for Hooked Underlying Ntapis (Which are False Positives) , for c/cpp Usage

TryHackMe

THM Walkthroughs

HTB

SSH_Bruter

Bruteforces ssh creds.

Simple_Port_Scanner

Scans Single port as well as Multiple Ports

C-for-Everyone-Programming-Fundamentals

All the topics and concepts of C programming that I have learned so far. The things covered in this repo are all beginner-friendly.

reveng007

reveng007.github.io