VirtualAllocEx (@VirtualAlllocEx)
github

VirtualAlllocEx

Twitter logo Share LinkedIn logo Share Facebook logo Share
  • Stars
    star
    1,696
  • Global Rank 18,209 (Top 0.7 %)
  • Followers 617
  • Following 20
  • Registered over 5 years ago
  • Most used languages
    C++
         40.0 %
    C
         26.7 %
    PowerShell
         20.0 %
    Python
         6.7 %
    HTML
         6.7 %

Top repositories

1

DEFCON-31-Syscalls-Workshop

Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".
C
613
star
2

Payload-Download-Cradles

This are different types of download cradles which should be an inspiration to play and create new download cradles to bypass AV/EPP/EDR in context of download cradle detections.
PowerShell
257
star
3

Create-Thread-Shellcode-Fetcher

This POC gives you the possibility to compile a .exe to completely avoid statically detection by AV/EPP/EDR of your C2-shellcode and download and execute your C2-shellcode which is hosted on your (C2)-webserver.
C++
247
star
4

Direct-Syscalls-vs-Indirect-Syscalls

The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls
C
156
star
5

Direct-Syscalls-A-journey-from-high-to-low

Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).
C
127
star
6

Taskschedule-Persistence-Download-Cradles

Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged
HTML
86
star
7

DSC_SVC_REMOTE

This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for local privilege escalation in the context of an unquoted service path, etc. The payload itself can be remotely hosted, downloaded via the wininet library and then executed via direct system calls.
C
50
star
8

AV-EPP-EDR-Windows-API-Hooking-List

Depending on the AV/EDR we will check which Windows APIs are hooked by the AV/EDR
30
star
9

Create_Thread_Inline_Assembly_x86

This POC provides the possibilty to execute x86 shellcode in form of a .bin file based on x86 inline assembly
C++
17
star
10

C2-Traffic-Redirection

Different possibilities to redirect the C2 traffic with a redirector instance to your C2-server
13
star
11

Shell-we-Assembly

Shellcode execution via x86 inline assembly based on MSVC syntax
C++
12
star
12

Conference-Slides

6
star
13

Create_Thread-Inline_Assembly_x86_Fibers

This POC provides the ability to execute x86 shellcode in the form of a .bin file based on x86 inline assembly and execution over fibers
C++
6
star
14

Mailfilter-and-Firewall-Check

Different attachment file types to check, which attachment types can be downloaded from your windows environment
Python
5
star
15

ObfLoader

MAC, IPv4, UUID shellcode Loaders and Obfuscators to obfuscate the shellcode and using some native API to converts it to it binary format and loads it.
C++
2
star
16

PRE-Pentest

Possibilities to gather information before preparing your malware
PowerShell
2
star
17

Messagebox-Test

PowerShell
1
star
18

Conferences-Slides

Slides from conferences where I have spoken
1
star
19

ProcessInjection

Code for an upcoming course regarding Process Injection techniques
C++
1
star