hacking-material-books icon indicating copy to clipboard operation
hacking-material-books copied to clipboard

common format strings obfuscation technics

Open r00t-3xp10it opened this issue 6 years ago • 7 comments


banner

This issue its direct linked to 'common format strings obfuscation technics' article:

[$] GitHub Article: common format strings obfuscation technics :1st_place_medal:



If you have some new technics to describe that you wish to seen published under that article, (contributing to its growing) leave a comment that i will review it/test it and publish it under the article with a special note describing your name (nickname)..

Thanks ..and long live the open source comunity ..

r00t-3xp10it avatar Mar 10 '18 05:03 r00t-3xp10it

Hello pedro how are you i am 3xploit the youtobe

3xploit666 avatar May 06 '18 01:05 3xploit666

@r00t-3xp10it This repo really helps me a lot.Very informative and well written.

usama7628674 avatar Dec 28 '18 03:12 usama7628674

@r00t-3xp10it do u bave any idea how can exeucte powershell payload without "powershell.exe" Instead of : powershell.exe -nop -w 1 - enc ... By this example(without powershell.exe) -nop -w 1 -enc ... Run a powershell script without the begining keyword powershell.exe

Did not want to open thread cause of this

joker8989 avatar Sep 03 '19 15:09 joker8989

yes i know how .. read this - defcon27 Lab 5

r00t-3xp10it avatar Sep 03 '19 15:09 r00t-3xp10it

According to your tool this does not create powershell process so i dont need to bypass AMSI right? Or i need?

joker8989 avatar Sep 03 '19 15:09 joker8989

P.S its not my tool (defcon27) and yes.. thats the objective of lab 5 exercise presented in defcon27 conference

r00t-3xp10it avatar Sep 03 '19 16:09 r00t-3xp10it

Ok i will try that just for any case do u know a command to run the -enc from powershell i mean without the powershell.exe keyword (the begining of the line)..

joker8989 avatar Sep 03 '19 16:09 joker8989