3xpl01tc0d3r

Hello All, In the post I will highlight few updates that are made to improve the code base & add long pending features to the Process Injection Tool that I wrote for learning about various Process Injection techniques and to enhance my knowledge about C# and Windows API. The tool for process injection can be found on my Github. https://github.com/3xpl01tc0d3r/ProcessInjection New Features: 1) Encryption - Added XOR & AES encryption support with custom key that needs to be passed to decrypt the shellcode at runtime. To encrypt the shellcode I have wrote another tool Obfuscator . I have wrote another short blog post for Obfuscator tool that can be found here . The tool currently only supports XOR & AES encryption. Obfuscated shellcode might help operator's to evade static detection while trying to inject the shellcode into remote process.  Required parameters to leverage Encryption: /enc  : This parameter is used to specify the encryption type(xor or aes). /key : Th...

Hello All, In this post we will cover how can we leverage GadgetToJScript for generating payload in various supported format such as HTA, JS, VBS & VBA(macro) which will execute our covenant grunt(Grunt is the implant for  Covenant  C2 framework). Wondering why are we using  GadgetToJScript  tool to generate  Covenant  payload in hta / js format wherein  Covenant  has default launcher to generate hta / js payload ? Covenant  uses  DotNetToJScript  for generating payloads in hta / js format which indeed doesn't work well with Windows 10 environment. We can see the note in the description field. DotNetToJScript  - A tool to generate a JScript which bootstraps an arbitrary .NET Assembly and class. GadgetToJScript  - A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS based scripts....