3xpl01tc0d3r

Hello All, In the post I will highlight few updates that are made to improve the code base & add long pending features to the Process Injection Tool that I wrote for learning about various Process Injection techniques and to enhance my knowledge about C# and Windows API. The tool for process injection can be found on my Github. https://github.com/3xpl01tc0d3r/ProcessInjection New Features: 1) Encryption - Added XOR & AES encryption support with custom key that needs to be passed to decrypt the shellcode at runtime. To encrypt the shellcode I have wrote another tool Obfuscator . I have wrote another short blog post for Obfuscator tool that can be found here . The tool currently only supports XOR & AES encryption. Obfuscated shellcode might help operator's to evade static detection while trying to inject the shellcode into remote process.  Required parameters to leverage Encryption: /enc  : This parameter is used to specify the encryption type(xor or aes). /key : Th...

Hello All, In this post I will provide you an overview about the new tool that I wrote to encrypt the shellcode using XOR & AES encryption. This tool has been written to support the new features added to the process injection tool that I wrote for learning about various Process Injection techniques and to enhance my knowledge about C# and Windows API.  The tool for process injection can be found on my github repo https://github.com/3xpl01tc0d3r/ProcessInjection The tool Obfuscator can also be found on my github repo https://github.com/3xpl01tc0d3r/Obfuscator What is encryption ? In cryptography, encryption is the process of encoding information.This process converts the original representation of the information, known as plaintext, into an alternative form known as ciphertext. Only authorized parties can decipher a ciphertext back to plaintext and access the original information. What is shellcode ? Shellcode is a set of instructions that executes a command in the software to ...

Hello All, Performing Red Team assessments are becoming challenging day by day. In mature environments we see a lot of custom tool development and new techniques are getting discovered by the community to overcome various challenges. While thinking about such challenges, I came up with the idea of creating a tool that can leverage legitimate services for establishing command & control communication channel which is likely to be whitelisted or are less monitored due to the nature of services used by the corporate environments. This is not a new technique, we have already seen similar projects that were developed to leverage legitimate services for command & control. Communication channels such as Slackor for Slack C2, DaaC2 for Discord C2 or  Domain Fronting techniques etc. In this post I will introduce you to a tool called "Callidus" which I created to learn & to improve my knowledge about developing custom toolset in C# and learning how to leverage ...

Hello All, In this post we will cover how can we leverage GadgetToJScript for generating payload in various supported format such as HTA, JS, VBS & VBA(macro) which will execute our covenant grunt(Grunt is the implant for  Covenant  C2 framework). Wondering why are we using  GadgetToJScript  tool to generate  Covenant  payload in hta / js format wherein  Covenant  has default launcher to generate hta / js payload ? Covenant  uses  DotNetToJScript  for generating payloads in hta / js format which indeed doesn't work well with Windows 10 environment. We can see the note in the description field. DotNetToJScript  - A tool to generate a JScript which bootstraps an arbitrary .NET Assembly and class. GadgetToJScript  - A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS based scripts....

Hello All, Wondering where is the part IV of the process injection blog post series ? The part IV of this series was written by Renos  on  Parent PID Spoofing  technique. Parent PID Spoofing technique is useful for evading detection. In this post I will cover about Asynchronous Procedure Calls (APC) Queue Process Injection technique. Parent PID Spoofing can also be used with APC Queue Process Injection. The tool can be found on my github repo . What is Asynchronous Procedure Calls (APC) ? This is best described by Microsoft in their documentation . Below is the short brief about APC from the Microsoft Docs. An asynchronous procedure call (APC) is a function that executes asynchronously in the context of a particular thread. When an APC is queued to a thread, the system issues a software interrupt. The next time the thread is scheduled, it will run the APC function. An APC generated by the system is called a kernel-mode APC. An APC generated by an application i...