admin/trickster0-OffensiveRust
1
0
Fork 0
mirror of https://github.com/trickster0/OffensiveRust synced 2026-06-08 17:54:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

adding EnumSystemGeoID shellcode poc

Browse Source
This commit is contained in:
husky
2022-03-30 08:48:11 -04:00
parent 6a281286ba
commit 7e629440f3
1 changed files with 28 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+28 -27
View File
@@ -31,33 +31,34 @@ My experiments in weaponizing [Rust](https://www.rust-lang.org/) for implant dev
## Examples in this repo
| File | Description |
| --- | --- |
| [Allocate_With_Syscalls](../master/Allocate_With_Syscalls/src/main.rs) | It uses NTDLL functions directly with the ntapi Library |
| [Create_DLL](../master/Create_DLL/src/lib.rs) | Creates DLL and pops up a msgbox, Rust does not fully support this so things might get weird since Rust DLL do not have a main function |
| [DeviceIoControl](../master/DeviceIoControl/src/main.rs) | Opens driver handle and executing DeviceIoControl |
| [EnableDebugPrivileges](../master/EnableDebugPrivileges/src/main.rs) | Enable SeDebugPrivilege in the current process |
| [Shellcode_Local_inject](../master/Shellcode_Local_inject/src/main.rs) | Executes shellcode directly in local process by casting pointer |
| [Execute_With_CMD](../master/Execute_Without_Create_Process/src/main.rs) | Executes cmd by passing a command via Rust |
| [ImportedFunctionCall](../master/ImportedFunctionCall/src/main.rs) | It imports minidump from dbghelp and executes it |
| [Kernel_Driver_Exploit](../master/Kernel_Driver_Exploit/src/main.rs) | Kernel Driver exploit for a simple buffer overflow |
| [Named_Pipe_Client](../master/Named_Pipe_Client/src/main.rs) | Named Pipe Client |
| [Named_Pipe_Server](../master/Named_Pipe_Server/src/main.rs) | Named Pipe Server |
| [Process_Injection_CreateThread](../master/Process_Injection_CreateThread/src/main.rs) | Process Injection in running process with CreateThread |
| [Process_Injection_CreateRemoteThread](../master/Process_Injection_CreateRemoteThread/src/main.rs) | Process Injection in remote process with CreateRemoteThread |
| [Unhooking](../master/Unhooking/src/main.rs) | Unhooking calls|
| [asm_syscall](../master/asm_syscall/src/main.rs) | Obtaining PEB address via asm |
| [base64_system_enum](../master/base64_system_enum/src/main.rs) | Base64 encoding/decoding strings |
| [http-https-requests](../master/http-https-requests/src/main.rs) | HTTP/S requests by ignoring cert check for GET/POST |
| [patch_etw](../master/patch_etw/src/main.rs) | Patch ETW |
| [ppid_spoof](../master/ppid_spoof/src/main.rs) | Spoof parent process for created process |
| [tcp_ssl_client](../master/tcp_ssl_client/src/main.rs) | TCP client with SSL that ignores cert check (Requires openssl and perl to be installed for compiling) |
| [tcp_ssl_server](../master/tcp_ssl_server/src/main.rs) | TCP Server, with port parameter(Requires openssl and perl to be installed for compiling) |
| [wmi_execute](../master/wmi_execute/src/main.rs) | Executes WMI query to obtain the AV/EDRs in the host|
| [Windows.h+ Bindings](../master/bindings.rs) | This file contains structures of Windows.h plus complete customized LDR,PEB,etc.. that are undocumented officially by Microsoft, add at the top of your file include!("../bindings.rs"); |
| [UUID_Shellcode_Execution](../master/UUID_Shellcode_Execution/src/main.rs) | Plants shellcode from UUID array into heap space and uses `EnumSystemLocalesA` Callback in order to execute the shellcode. |
| [AMSI Bypass](../master/amsi_bypass/src/main.rs) | AMSI Bypass on Local Process |
| [Injection_AES_Loader](../master/Injection_AES_Loader/src/main.rs) | NtTestAlert Injection with AES decryption |
| File | Description |
|--------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [Allocate_With_Syscalls](../master/Allocate_With_Syscalls/src/main.rs) | It uses NTDLL functions directly with the ntapi Library |
| [Create_DLL](../master/Create_DLL/src/lib.rs) | Creates DLL and pops up a msgbox, Rust does not fully support this so things might get weird since Rust DLL do not have a main function |
| [DeviceIoControl](../master/DeviceIoControl/src/main.rs) | Opens driver handle and executing DeviceIoControl |
| [EnableDebugPrivileges](../master/EnableDebugPrivileges/src/main.rs) | Enable SeDebugPrivilege in the current process |
| [Shellcode_Local_inject](../master/Shellcode_Local_inject/src/main.rs) | Executes shellcode directly in local process by casting pointer |
| [Execute_With_CMD](../master/Execute_Without_Create_Process/src/main.rs) | Executes cmd by passing a command via Rust |
| [ImportedFunctionCall](../master/ImportedFunctionCall/src/main.rs) | It imports minidump from dbghelp and executes it |
| [Kernel_Driver_Exploit](../master/Kernel_Driver_Exploit/src/main.rs) | Kernel Driver exploit for a simple buffer overflow |
| [Named_Pipe_Client](../master/Named_Pipe_Client/src/main.rs) | Named Pipe Client |
| [Named_Pipe_Server](../master/Named_Pipe_Server/src/main.rs) | Named Pipe Server |
| [Process_Injection_CreateThread](../master/Process_Injection_CreateThread/src/main.rs) | Process Injection in running process with CreateThread |
| [Process_Injection_CreateRemoteThread](../master/Process_Injection_CreateRemoteThread/src/main.rs) | Process Injection in remote process with CreateRemoteThread |
| [Process_Injection_Self_EnumSystemGeoID](../master/Process_Injection_Self_EnumSystemGeoID/src/main.rs) | Self injector that uses the EnumSystemsGeoID API call to run shellcode. |
| [Unhooking](../master/Unhooking/src/main.rs) | Unhooking calls |
| [asm_syscall](../master/asm_syscall/src/main.rs) | Obtaining PEB address via asm |
| [base64_system_enum](../master/base64_system_enum/src/main.rs) | Base64 encoding/decoding strings |
| [http-https-requests](../master/http-https-requests/src/main.rs) | HTTP/S requests by ignoring cert check for GET/POST |
| [patch_etw](../master/patch_etw/src/main.rs) | Patch ETW |
| [ppid_spoof](../master/ppid_spoof/src/main.rs) | Spoof parent process for created process |
| [tcp_ssl_client](../master/tcp_ssl_client/src/main.rs) | TCP client with SSL that ignores cert check (Requires openssl and perl to be installed for compiling) |
| [tcp_ssl_server](../master/tcp_ssl_server/src/main.rs) | TCP Server, with port parameter(Requires openssl and perl to be installed for compiling) |
| [wmi_execute](../master/wmi_execute/src/main.rs) | Executes WMI query to obtain the AV/EDRs in the host |
| [Windows.h+ Bindings](../master/bindings.rs) | This file contains structures of Windows.h plus complete customized LDR,PEB,etc.. that are undocumented officially by Microsoft, add at the top of your file include!("../bindings.rs"); |
| [UUID_Shellcode_Execution](../master/UUID_Shellcode_Execution/src/main.rs) | Plants shellcode from UUID array into heap space and uses `EnumSystemLocalesA` Callback in order to execute the shellcode. |
| [AMSI Bypass](../master/amsi_bypass/src/main.rs) | AMSI Bypass on Local Process |
| [Injection_AES_Loader](../master/Injection_AES_Loader/src/main.rs) | NtTestAlert Injection with AES decryption |
## Compiling the examples in this repo