From 377a405c8585b18709cd66fa74256957fe0bc92c Mon Sep 17 00:00:00 2001 From: Yarden Shafir Date: Wed, 3 Jun 2020 19:57:59 +0300 Subject: [PATCH] Commands from opcde keynote --- OPCDE/opcde_commands | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 OPCDE/opcde_commands diff --git a/OPCDE/opcde_commands b/OPCDE/opcde_commands new file mode 100644 index 0000000..9f1a0b5 --- /dev/null +++ b/OPCDE/opcde_commands @@ -0,0 +1,26 @@ +OPCDE Keynote - commands and steps: + +1. Explore built-in registers - @$curthread, @$curprocess, @$cursession... + Print process array in decimal: dx @$cursession.Processes, d + +2. Find explorer.exe and its signature level: + dx @$cursession.Processes.Where(p => p.Name == "explorer.exe").KernelObject.SignatureLevel & 0xF + +3. Print signature level for all processes: + dx -r2 @$cursession.Processes.Select(p => p.KernelObject.SignatureLevel) + +4. Use anonymous type to print more information for each process, use -r2 to show 2 levels, use -g for grid view, order by signature level: + dx -r2 @$cursession.Processes.Select(p => new {Name = p.Name, PID = p.Id, SignatureLevel = p.KernelObject.SignatureLevel & 0xF}).OrderBy(p => p.SignatureLevel) + +5. Conditional Breakpoint - use bp /w to break on nt!NtWriteFile only when writing thread is impersonating: + bp /w "@$curthread.KernelObject.ClientSecurity.ImpersonationData != 0" nt!NtWriteFile + +6. When breakpoint is hit, use anonymous type to print process name, thread ID, impersonation token authentication ID and name of file that's written into, and keep running: + bp /w "@$curthread.KernelObject.ClientSecurity.ImpersonationData != 0" nt!NtWriteFile "dx new { ProcName = @$curprocess.Name, ThreadId = @$curthread.Id, + AuthId = ((nt!_TOKEN*)(@$curthread.KernelObject.ClientSecurity.ImpersonationToken & ~0xF))->AuthenticationId.LowPart, + FileName = @$curprocess.Io.Handles[@rcx].Object.UnderlyingObject.FileName}; g" + +Bonus - How to choose number of items printed from an array: + Only show first 10 items: dx @$cursession.Processes, 10 + Show 9999 items: dx @$cursession.Processes, 9999 + Show all items in array: dx @$cursession.Processes, [@$cursession.Processes.Count()] \ No newline at end of file