Category Archives: programming

WOW64 Callback Table (FinFisher)

Posted on April 19, 2023 by odzhan

Introduction Ken Johnson (otherwise known as Skywing) first talked about the KiUserExceptionDispatcher back in 2007 . Since then, scattered around the internet are various posts talking about it, but for some reason nobody demonstrating how to use it. It’s been … Continue reading →

Posted in assembly, data structures, programming, security, windows | Tagged , , | 1 Comment

Windows Process Injection: Command Line and Environment Variables

Posted on July 31, 2020 by odzhan

Windows Process Injection: Command Line and Environment Variables Contents Introduction Shellcode Environment Variables Command Line Window Title Runtime Data 1. Introduction There are many ways to load shellcode into the address space of a process, but knowing precisely where it’s … Continue reading →

Posted in assembly, injection, malware, process injection, programming, redteam, security, shellcode, windows | Tagged , , , , , | 1 Comment

Windows Process Injection: Breaking BaDDEr

Posted on August 9, 2019 by odzhan

Introduction Dynamic Data Exchange (DDE) is a data sharing protocol while the Dynamic Data Exchange Management Library (DDEML) facilitates sharing of data among applications over the DDE protocol. DDE made the headlines in October 2017 after a vulnerability was discovered … Continue reading →

Posted in injection, malware, process injection, programming, windows | Tagged , , , , | Leave a comment

Shellcode: In-Memory Execution of JavaScript, VBScript, JScript and XSL

Posted on July 21, 2019 by odzhan

Introduction A DynaCall() Function for Win32 was published in the August 1998 edition of Dr.Dobbs Journal. The author, Ton Plooy, provided a function in C that allows an interpreted language such as VBScript to call external DLL functions via a … Continue reading →

Posted in assembly, programming, security, shellcode, windows | Tagged , , , , , , , | Leave a comment

Shellcode: In-Memory Execution of DLL

Posted on June 24, 2019 by odzhan

Introduction In March 2002, the infamous group 29A published their sixth e-zine. One of the articles titled In-Memory PE EXE Execution by Z0MBiE demonstrated how to manually load and run a Portable Executable entirely from memory. The InMem client provided … Continue reading →

Posted in assembly, injection, programming, security, shellcode, windows | Tagged , , , | 4 Comments

Shellcode: Loading .NET Assemblies From Memory

Posted on May 10, 2019 by odzhan

Introduction The dot net Framework can be found on almost every device running Microsoft Windows. It is popular among professionals involved in both attacking (Red Team) and defending (Blue Team) a Windows-based device. In 2015, the Antimalware Scan Interface (AMSI) … Continue reading →

Posted in assembly, encryption, malware, programming, security, shellcode, windows | Tagged , , , , , , | 2 Comments

How the L0pht (probably) optimized attack against the LanMan hash.

Posted on February 2, 2019 by odzhan

Introduction Data Encryption Standard The LanMan Algorithm Brute Force Attack Version 1 Precomputing Key Schedules 1 Version 2 Using Macros For The Key Schedule Algorithm Initial and Final Permutation Skipping Rounds Version 3 Precomputing Key Schedules 2 Version 4 Results … Continue reading →

Posted in cryptography, passwords, programming, security, windows | Tagged , , , , | 1 Comment