# The Real Hugo

Enumeration

Containers

Docs

- aws
- cewl
- dns
- docker_enumeration
- ffuf
- gobuster
- kerberoast
- kubectl
- ldap
- linux_basics
- microk8s
- nfs
- nikto
- nmap
- port_knocking
- rpcclient
- rsync
- rustscan
- shodan
Snmp

- onesixtyone
- snmpcheck

- websites
- wfuzz
- wpscan

Network_scanners

Windows

- bloodhound
- event_log
- manual_enum
- powershell
- rpcclient
- sysinternals
- sysmon
- vss

Exploit

CPUs

- meltdown

Binaries

- Shellcode
- aslr
Buffer_overflow

Docs

- amd64
- amd64_instructions
- buffer_overflow
- cut_stack_in_half
- pwntools_specifics
- ret_address_reuse

- ropping

Canary_bypass

- canary_bypass

Format_string

- format_string

Integral_promotion

- integral_promotion

- plt_got
- r2
- ret2libc

Dns

- zone_transfer

Hashes

- collision

Imagemagick

- imagetragick

Java

OGNL

- cve_2022_26134

- ghidra_debug
- ghostcat
- log4shell
- spring4shell

Level3_hypervisor

Docker_sec

- docker

- kubernetes
- lxc
- microk8s

Linux

- capabilities
Dirty_pipe

- dirty_pipe

- exiftool
- groups
- ld_preload
- nfs_rootsquash
- overlayfs
Pkexec

- CVE_2021_4034

- polkit
- racing_conditions
- setcap
- shared_object_injection
- shell_shock
Sudo

- CVE_2019_14287
- CVE_2019_18634
- baron_samedit
- tokens

- wildard_exploitation

MacOS

Network

- mac_spoofing

Padding

- padbuster

Python

- code_injection
- jail_escape
- lib_hijack
- pickle
- pwntools
- pyc
- scapy

Samba

- smbmap

Sqli

- mssql
- no_sqli
- sqli
- sqlmap

Ssl_tls

- heartbleed

Web

Bypass_rate_limiting

- bypass_rate_limiting

- command_injection
Content_security_policy

- content_security_policy

- cookie_tampering
- csrf
Forced_browsing

- forced_browsing

- http_header_injection
Idor

- idor

Javascript

- bypass_filters
- prototype_pollution

Jwt

- jwt

- local_file_inclusion
- methodology
Nodejs

- deserialization

Php

- command_injection
- password_reset
- php_base64_filter
- php_image_exif
- php_user_agent_rce
- preload_lib
- unserialize

- re_registration
- remote_file_inclusion
Ssrf

- iframe
- ssrf

Ssti

- ssti

- url_forgery
- wordpress
- xpath
- xss
Xxe

- wp_xxe_
- xml_external_entity

Windows

Portable Executables

- Shellcode

Dll_hijacking

- dll_hijacking

Docs

- always_installed_elevated
- crackmapexec
- dpapi
- impacket
- llmnr
- lnk_exploit
- pass_the_hash
- password_in_registry
- potatoes
- printnightmare
- responder
- unquoted_path

Macros

- macros

Payloads

- windows_scripting_host

Print_nightmare

CVE-2021-1675

Nightmare-dll

- print_nightmare

Process_injection

- dll_injection
- process_hollowing
- shellcode_injection
- thread_hijacking

Service_escalation

- service_escalation

Zero_logon

- zero_logon

Yaml

- deserialization

Forensics

- ios
- kape
- ntfs
- oletools
- volatility
- windows_registry

Hashes

Bruteforce

- patator

- generate_wordlists
- haiti
- hashcat_utils
Password_cracking

- hydra
- john
- smb_challenge
- sucrack
- vnc

Password_guessing

- standard_passwords

Persistence

- bashrc
- crontab
- meterpreter
- persistence
- wmi

Post exploitation

Seatbelt

.github

ISSUE_TEMPLATE

- bug_report
- feature_request

- CHANGELOG
Seatbelt

Commands

Windows

EventLogs

Output

Bc_security

Docs

- c2
- crackmapexec
- empire
- ids_ips_evation
- linux
- metasploit
- mimikatz
- mitm
- nfs_root_squash
- powershell
- secretsdump
Windows

- Signature-Evasion
- antivirus_evasion
- applocker
- evade_event_tracing
- living_off_the_land
- pass_the_hash
- powershell_logs
- registry
- sebackupprivilege
- user_account_control

- pivoting
Priv_esc

Docs

- linux_priv_esc
- pspy
Windows

- add_user
- windows_priv_esc

Kernel-exploits

Privesc-scripts

Docs

- get_script_onto_target

Suid

Reverse engineering

Android

- misc

Docs

- deobfuscation
- dll_reversing
- firmware
- function_mangling
- scada

Java

- krakatau

Windows

- portable-executable

Reverse shells

Docs

- evil-winrm
- msfconsole
- msfvenom
- netcat
- powershell
- shell_upgrade
- socat
- webshell

- firewalls
Windows

- amd64 instructions
  - Values
  - Move
  - Arithmetic
  - Conditionals
  - Address Handling
  - Zero Handling in Registers
  - Jumps
  - Flags
    - Status
  - Calling Conventions
  - cdecl
  - fastcall

# amd64 instructions

- `;` starts a comment

## Values

- Immediate, numbers
- register, existing registers
- memory, memory addresses

## Move

- `MOV`, from source to destination
- `LEA`, loads memory address and stores it in the destination. Address can have an offset. Does not dereference `[var]` or `[var+x]`
- `PUSH` & `POP`, put & delete registers to/from stack.

## Arithmetic

- `INC`, increment
- `DEC`, decrement
- `ADD`
- `SUB`, substracts source from dest and stores in dest
- `MUL` & `IMUL`, result may be stored in upper and lower halfs (rdx:rax)
- `DIV` & `IDIV`, rax is divided by rbx and may be stored in two halfs as well

## Conditionals

- `RET`, return value to the caller
- `CMP`, compare two values and sets flag. Next instruction is a jump condition to a line number. Works as follows
  - `JE`, `JEZ`, `JLE` ... followed by linenumber
- `NOP`, `\x90`
- `CALL` a function

## Address Handling

- `[var]`, memory address of var.
  - If var contains an address then after `mov [var], 42` var points to the value 42. `[` dereference.

## Zero Handling in Registers

- Move to `eax` will result in zeroing the upper 32 bit of an `rax` register, move to `ax`, `ah`, `al` will not.
- `MOVZX` zeros anything but the value moved to the register inside of it.

## Jumps

- For signed value comparison

  - `JL/JNGE` (SF <> OF) ; Jump if less/not greater or equal
  - `JGE/JNL` (SF = OF) ; Jump if greater or equal/not less
  - `JLE/JNG` (ZF = 1 or SF <> OF); Jump if less or equal/not greater
  - `JG/JNLE` (ZF = 0 and SF = OF); Jump if greater/not less or equal

- For unsigned value comparison

  - `JB/JNAE` (CF = 1) ; Jump if below/not above or equal
  - `JAE/JNB` (CF = 0) ; Jump if above or equal/not below
  - `JBE/JNA` (CF = 1 or ZF = 1) ; Jump if below or equal/not above
  - `JA/JNBE` (CF = 0 and ZF = 0); Jump if above/not below or equal

## Flags

- `eflags` 32bit
- `rflags` 64bit

### Status

- Zero Flag (ZF), 1 if the result of the comparison is equal.
- Carry Flag (CF), a 1 is stored if a carry is needed after a calculation.
- Overflow Flag (OF), register overflow is 1
- Sign Flag (SF), 1 if result is negative.
- Adjust/Auxiliary Flag (AF), carry flag for BCD.
- Parity Flag (PF), 1 if the last 8 bits are even.
- Trap Flag (TF)

## Calling Conventions

## cdecl

## fastcall

- First four are passed left to right
- int -> RCX, RDX, R8, R9
- float -> XMM0, XMM1, XMM2, XMM3
- Rest is right to left
- Basepointer is saved by the caller
- Return values is passes via `rax` or `xmm0`
- Caller allocates space for at least four values, so 32 bytes are reserved. `$rsp to $rsp+0x18`
- Volatile registers are `rax, rcx, r8, r9, r10, r11, xmm0, xmm1, xmm2, xmm3, xmm4, xmm5`. These are destroyed after function call.
- Nonvolatile registers are `rbx, rbp, rdi, rsi, rsp, r12, r13, r14, r15, xmm6-15` ares saved and restored after function call.