Repository: SinaKarvandi/Process-Magics
Branch: master
Commit: a3e822417920
Files: 58
Total size: 85.3 KB
Directory structure:
gitextract_gethi38c/
├── .gitignore
├── Bypass Sysmon With Updating Rules/
│ ├── SysmonRuleUpdateBypass/
│ │ ├── SysmonDataRecv/
│ │ │ ├── SysmonDataRecv.cpp
│ │ │ ├── SysmonDataRecv.vcxproj
│ │ │ ├── SysmonDataRecv.vcxproj.filters
│ │ │ ├── SysmonDataRecv.vcxproj.user
│ │ │ ├── pch.cpp
│ │ │ └── pch.h
│ │ └── SysmonDataRecv.sln
│ ├── bypass.xml
│ ├── bypass_edr.reg
│ └── readme.md
├── CriticalProcess/
│ ├── CriticalProcess/
│ │ ├── CriticalProcess.cpp
│ │ ├── CriticalProcess.vcxproj
│ │ ├── CriticalProcess.vcxproj.filters
│ │ ├── CriticalProcess.vcxproj.user
│ │ ├── pch.cpp
│ │ └── pch.h
│ └── CriticalProcess.sln
├── EnumAllHandles/
│ ├── EnumAllHandles/
│ │ ├── EnumAllHandles.cpp
│ │ ├── EnumAllHandles.vcxproj
│ │ ├── EnumAllHandles.vcxproj.filters
│ │ ├── EnumAllHandles.vcxproj.user
│ │ ├── pch.cpp
│ │ └── pch.h
│ └── EnumAllHandles.sln
├── Images/
│ └── readme.md
├── ImpersonateNtlmNegotiation/
│ ├── SSPI_Client/
│ │ ├── SSPI_Client/
│ │ │ ├── SSPI_Client.cpp
│ │ │ ├── SSPI_Client.vcxproj
│ │ │ ├── SSPI_Client.vcxproj.filters
│ │ │ ├── SSPI_Client.vcxproj.user
│ │ │ ├── SspiExample.h
│ │ │ ├── pch.cpp
│ │ │ └── pch.h
│ │ └── SSPI_Client.sln
│ └── SSPI_Server/
│ ├── SSPI_Server/
│ │ ├── SSPI_Server.cpp
│ │ ├── SSPI_Server.vcxproj
│ │ ├── SSPI_Server.vcxproj.filters
│ │ ├── SSPI_Server.vcxproj.user
│ │ ├── SspiExample.h
│ │ ├── pch.cpp
│ │ └── pch.h
│ └── SSPI_Server.sln
├── ImpersonationPipeLine/
│ ├── NamedPipeClient/
│ │ ├── NamedPipeClient/
│ │ │ ├── NamedPipeClient.cpp
│ │ │ ├── NamedPipeClient.vcxproj
│ │ │ ├── NamedPipeClient.vcxproj.filters
│ │ │ ├── NamedPipeClient.vcxproj.user
│ │ │ ├── pch.cpp
│ │ │ └── pch.h
│ │ └── NamedPipeClient.sln
│ └── NamedPipeServer/
│ ├── NamedPipeServer/
│ │ ├── NamedPipeServer.cpp
│ │ ├── NamedPipeServer.vcxproj
│ │ ├── NamedPipeServer.vcxproj.filters
│ │ ├── NamedPipeServer.vcxproj.user
│ │ ├── pch.cpp
│ │ └── pch.h
│ └── NamedPipeServer.sln
├── LICENSE
└── README.md
================================================
FILE CONTENTS
================================================
================================================
FILE: .gitignore
================================================
# Prerequisites
*.d
# Compiled Object files
*.slo
*.lo
*.o
*.obj
# Precompiled Headers
*.gch
*.pch
# Compiled Dynamic libraries
*.so
*.dylib
*.dll
# Fortran module files
*.mod
*.smod
# Compiled Static libraries
*.lai
*.la
*.a
*.lib
# Executables
*.exe
*.out
*.app
================================================
FILE: Bypass Sysmon With Updating Rules/SysmonRuleUpdateBypass/SysmonDataRecv/SysmonDataRecv.vcxproj
================================================
Debug
Win32
Release
Win32
Debug
x64
Release
x64
15.0
{163AB816-2959-4671-B3EE-06948359766E}
Win32Proj
SysmonDataRecv
10.0.18362.0
Application
true
v141
Unicode
Application
false
v141
true
Unicode
Application
true
v141
Unicode
Application
false
v141
true
Unicode
true
true
false
false
Use
Level3
Disabled
true
WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
%(AdditionalLibraryDirectories)
Use
Level3
Disabled
true
_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
false
MultiThreadedDebug
Console
true
C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\lib\amd64;%(AdditionalLibraryDirectories)
Use
Level3
MaxSpeed
true
true
true
WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
true
true
Use
Level3
MaxSpeed
true
true
true
NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
true
true
Create
Create
Create
Create
================================================
FILE: Bypass Sysmon With Updating Rules/SysmonRuleUpdateBypass/SysmonDataRecv/SysmonDataRecv.vcxproj.filters
================================================
{4FC737F1-C7A5-4376-A066-2A32D752A2FF}
cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx
{93995380-89BD-4b04-88EB-625FBE52EBFB}
h;hh;hpp;hxx;hm;inl;inc;ipp;xsd
{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
Header Files
Source Files
Source Files
================================================
FILE: Bypass Sysmon With Updating Rules/SysmonRuleUpdateBypass/SysmonDataRecv/SysmonDataRecv.vcxproj.user
================================================
================================================
FILE: Bypass Sysmon With Updating Rules/SysmonRuleUpdateBypass/SysmonDataRecv.sln
================================================
Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio 15
VisualStudioVersion = 15.0.28010.0
MinimumVisualStudioVersion = 10.0.40219.1
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "SysmonDataRecv", "SysmonDataRecv\SysmonDataRecv.vcxproj", "{163AB816-2959-4671-B3EE-06948359766E}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|x64 = Debug|x64
Debug|x86 = Debug|x86
Release|x64 = Release|x64
Release|x86 = Release|x86
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{163AB816-2959-4671-B3EE-06948359766E}.Debug|x64.ActiveCfg = Debug|x64
{163AB816-2959-4671-B3EE-06948359766E}.Debug|x64.Build.0 = Debug|x64
{163AB816-2959-4671-B3EE-06948359766E}.Debug|x86.ActiveCfg = Debug|Win32
{163AB816-2959-4671-B3EE-06948359766E}.Debug|x86.Build.0 = Debug|Win32
{163AB816-2959-4671-B3EE-06948359766E}.Release|x64.ActiveCfg = Release|x64
{163AB816-2959-4671-B3EE-06948359766E}.Release|x64.Build.0 = Release|x64
{163AB816-2959-4671-B3EE-06948359766E}.Release|x86.ActiveCfg = Release|Win32
{163AB816-2959-4671-B3EE-06948359766E}.Release|x86.Build.0 = Release|Win32
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {38AB2C15-8DBA-4B48-8593-B0603D0CBB68}
EndGlobalSection
EndGlobal
================================================
FILE: Bypass Sysmon With Updating Rules/bypass.xml
================================================
md5,sha256
C:\Windows\System32\BypassEDR.EDR1
C:\Windows\System32\BypassEDR.EDR2
C:\Windows\system32\BypassEDR.EDR
BypassEDR.EDR3
BypassEDR5
BypassEDR6
BypassEDR7
C:\Windows\system32\BypassEDR.EDR8
.bypassEDR.
================================================
FILE: Bypass Sysmon With Updating Rules/readme.md
================================================
This is the needed files for a Sysmon bypass
================================================
FILE: CriticalProcess/CriticalProcess/CriticalProcess.vcxproj
================================================
Debug
Win32
Release
Win32
Debug
x64
Release
x64
15.0
{EDC75EF4-4628-48AD-9082-785B6A4CA959}
Win32Proj
CriticalProcess
10.0.17763.0
Application
true
v141
Unicode
Application
false
v141
true
Unicode
Application
true
v141
Unicode
Application
false
v141
true
Unicode
true
true
false
false
Use
Level3
Disabled
true
WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
false
MultiThreadedDebug
Console
true
C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\lib;%(AdditionalLibraryDirectories)
Use
Level3
Disabled
true
_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
Use
Level3
MaxSpeed
true
true
true
WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
true
true
Use
Level3
MaxSpeed
true
true
true
NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
true
true
Create
Create
Create
Create
================================================
FILE: CriticalProcess/CriticalProcess/CriticalProcess.vcxproj.filters
================================================
{4FC737F1-C7A5-4376-A066-2A32D752A2FF}
cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx
{93995380-89BD-4b04-88EB-625FBE52EBFB}
h;hh;hpp;hxx;hm;inl;inc;ipp;xsd
{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
Header Files
Source Files
Source Files
================================================
FILE: CriticalProcess/CriticalProcess/CriticalProcess.vcxproj.user
================================================
================================================
FILE: CriticalProcess/CriticalProcess.sln
================================================
Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio 15
VisualStudioVersion = 15.0.28010.0
MinimumVisualStudioVersion = 10.0.40219.1
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CriticalProcess", "CriticalProcess\CriticalProcess.vcxproj", "{EDC75EF4-4628-48AD-9082-785B6A4CA959}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|x64 = Debug|x64
Debug|x86 = Debug|x86
Release|x64 = Release|x64
Release|x86 = Release|x86
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{EDC75EF4-4628-48AD-9082-785B6A4CA959}.Debug|x64.ActiveCfg = Debug|x64
{EDC75EF4-4628-48AD-9082-785B6A4CA959}.Debug|x64.Build.0 = Debug|x64
{EDC75EF4-4628-48AD-9082-785B6A4CA959}.Debug|x86.ActiveCfg = Debug|Win32
{EDC75EF4-4628-48AD-9082-785B6A4CA959}.Debug|x86.Build.0 = Debug|Win32
{EDC75EF4-4628-48AD-9082-785B6A4CA959}.Release|x64.ActiveCfg = Release|x64
{EDC75EF4-4628-48AD-9082-785B6A4CA959}.Release|x64.Build.0 = Release|x64
{EDC75EF4-4628-48AD-9082-785B6A4CA959}.Release|x86.ActiveCfg = Release|Win32
{EDC75EF4-4628-48AD-9082-785B6A4CA959}.Release|x86.Build.0 = Release|Win32
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {DFED5742-9898-4620-AC1C-E19D3E0F4086}
EndGlobalSection
EndGlobal
================================================
FILE: EnumAllHandles/EnumAllHandles/EnumAllHandles.vcxproj
================================================
Debug
Win32
Release
Win32
Debug
x64
Release
x64
15.0
{D9AF087A-D2A1-4533-A034-D94759B7796B}
Win32Proj
EnumAllHandles
10.0.17763.0
Application
true
v141
Unicode
Application
false
v141
true
Unicode
Application
true
v141
Unicode
Application
false
v141
true
Unicode
true
true
false
false
Use
Level3
Disabled
true
WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
%(AdditionalLibraryDirectories)
Use
Level3
Disabled
true
_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
Use
Level3
MaxSpeed
true
true
true
WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
true
true
%(AdditionalLibraryDirectories)
Use
Level3
MaxSpeed
true
true
true
NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
true
true
C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\lib\amd64;%(AdditionalLibraryDirectories)
Create
Create
Create
Create
================================================
FILE: EnumAllHandles/EnumAllHandles/EnumAllHandles.vcxproj.filters
================================================
{4FC737F1-C7A5-4376-A066-2A32D752A2FF}
cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx
{93995380-89BD-4b04-88EB-625FBE52EBFB}
h;hh;hpp;hxx;hm;inl;inc;ipp;xsd
{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
Header Files
Source Files
Source Files
================================================
FILE: EnumAllHandles/EnumAllHandles/EnumAllHandles.vcxproj.user
================================================
================================================
FILE: EnumAllHandles/EnumAllHandles.sln
================================================
Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio 15
VisualStudioVersion = 15.0.28010.0
MinimumVisualStudioVersion = 10.0.40219.1
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "EnumAllHandles", "EnumAllHandles\EnumAllHandles.vcxproj", "{D9AF087A-D2A1-4533-A034-D94759B7796B}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|x64 = Debug|x64
Debug|x86 = Debug|x86
Release|x64 = Release|x64
Release|x86 = Release|x86
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{D9AF087A-D2A1-4533-A034-D94759B7796B}.Debug|x64.ActiveCfg = Debug|x64
{D9AF087A-D2A1-4533-A034-D94759B7796B}.Debug|x64.Build.0 = Debug|x64
{D9AF087A-D2A1-4533-A034-D94759B7796B}.Debug|x86.ActiveCfg = Debug|Win32
{D9AF087A-D2A1-4533-A034-D94759B7796B}.Debug|x86.Build.0 = Debug|Win32
{D9AF087A-D2A1-4533-A034-D94759B7796B}.Release|x64.ActiveCfg = Release|x64
{D9AF087A-D2A1-4533-A034-D94759B7796B}.Release|x64.Build.0 = Release|x64
{D9AF087A-D2A1-4533-A034-D94759B7796B}.Release|x86.ActiveCfg = Release|Win32
{D9AF087A-D2A1-4533-A034-D94759B7796B}.Release|x86.Build.0 = Release|Win32
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {DE0B4417-B1B6-4AF3-B1E3-333C6FECB671}
EndGlobalSection
EndGlobal
================================================
FILE: Images/readme.md
================================================
list of images
================================================
FILE: ImpersonateNtlmNegotiation/SSPI_Client/SSPI_Client/SSPI_Client.vcxproj
================================================
Debug
Win32
Release
Win32
Debug
x64
Release
x64
15.0
{1E5D8131-82F4-4C28-AF3B-3D7FCD7F1366}
Win32Proj
SSPIClient
10.0.17763.0
Application
true
v141
Unicode
Application
false
v141
true
Unicode
Application
true
v141
Unicode
Application
false
v141
true
Unicode
true
true
false
false
Use
Level3
Disabled
true
WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
false
Console
true
C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\lib;%(AdditionalLibraryDirectories)
Use
Level3
Disabled
true
_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
Use
Level3
MaxSpeed
true
true
true
WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
true
true
C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\lib;%(AdditionalLibraryDirectories)
Use
Level3
MaxSpeed
true
true
true
NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
true
true
Create
Create
Create
Create
================================================
FILE: ImpersonateNtlmNegotiation/SSPI_Client/SSPI_Client/SSPI_Client.vcxproj.filters
================================================
{4FC737F1-C7A5-4376-A066-2A32D752A2FF}
cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx
{93995380-89BD-4b04-88EB-625FBE52EBFB}
h;hh;hpp;hxx;hm;inl;inc;ipp;xsd
{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
Header Files
Header Files
Source Files
Source Files
================================================
FILE: ImpersonateNtlmNegotiation/SSPI_Client/SSPI_Client/SSPI_Client.vcxproj.user
================================================
================================================
FILE: ImpersonateNtlmNegotiation/SSPI_Client/SSPI_Client/SspiExample.h
================================================
#pragma once
// SspiExample.h
#include
#include
BOOL SendMsg(SOCKET s, PBYTE pBuf, DWORD cbBuf);
BOOL ReceiveMsg(SOCKET s, PBYTE pBuf, DWORD cbBuf, DWORD *pcbRead);
BOOL SendBytes(SOCKET s, PBYTE pBuf, DWORD cbBuf);
BOOL ReceiveBytes(SOCKET s, PBYTE pBuf, DWORD cbBuf, DWORD *pcbRead);
void cleanup();
BOOL GenClientContext(
BYTE *pIn,
DWORD cbIn,
BYTE *pOut,
DWORD *pcbOut,
BOOL *pfDone,
CHAR *pszTarget,
CredHandle *hCred,
struct _SecHandle *hcText
);
BOOL GenServerContext(
BYTE *pIn,
DWORD cbIn,
BYTE *pOut,
DWORD *pcbOut,
BOOL *pfDone,
BOOL fNewCredential
);
BOOL EncryptThis(
PBYTE pMessage,
ULONG cbMessage,
BYTE ** ppOutput,
LPDWORD pcbOutput,
ULONG securityTrailer
);
PBYTE DecryptThis(
PBYTE achData,
LPDWORD pcbMessage,
_SecHandle *hCtxt,
ULONG cbSecurityTrailer
);
BOOL
SignThis(
PBYTE pMessage,
ULONG cbMessage,
BYTE ** ppOutput,
LPDWORD pcbOutput
);
PBYTE VerifyThis(
PBYTE pBuffer,
LPDWORD pcbMessage,
_SecHandle *hCtxt,
ULONG cbMaxSignature
);
void PrintHexDump(DWORD length, PBYTE buffer);
BOOL ConnectAuthSocket(
SOCKET *s,
CredHandle *hCred,
_SecHandle *hcText
);
BOOL CloseAuthSocket(SOCKET s);
BOOL DoAuthentication(SOCKET s);
void MyHandleError(char *s);
================================================
FILE: ImpersonateNtlmNegotiation/SSPI_Client/SSPI_Client.sln
================================================
Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio 15
VisualStudioVersion = 15.0.28010.0
MinimumVisualStudioVersion = 10.0.40219.1
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "SSPI_Client", "SSPI_Client\SSPI_Client.vcxproj", "{1E5D8131-82F4-4C28-AF3B-3D7FCD7F1366}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|x64 = Debug|x64
Debug|x86 = Debug|x86
Release|x64 = Release|x64
Release|x86 = Release|x86
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{1E5D8131-82F4-4C28-AF3B-3D7FCD7F1366}.Debug|x64.ActiveCfg = Debug|x64
{1E5D8131-82F4-4C28-AF3B-3D7FCD7F1366}.Debug|x64.Build.0 = Debug|x64
{1E5D8131-82F4-4C28-AF3B-3D7FCD7F1366}.Debug|x86.ActiveCfg = Debug|Win32
{1E5D8131-82F4-4C28-AF3B-3D7FCD7F1366}.Debug|x86.Build.0 = Debug|Win32
{1E5D8131-82F4-4C28-AF3B-3D7FCD7F1366}.Release|x64.ActiveCfg = Release|x64
{1E5D8131-82F4-4C28-AF3B-3D7FCD7F1366}.Release|x64.Build.0 = Release|x64
{1E5D8131-82F4-4C28-AF3B-3D7FCD7F1366}.Release|x86.ActiveCfg = Release|Win32
{1E5D8131-82F4-4C28-AF3B-3D7FCD7F1366}.Release|x86.Build.0 = Release|Win32
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {BCC7D16C-6F77-48D2-824E-5692FA004665}
EndGlobalSection
EndGlobal
================================================
FILE: ImpersonateNtlmNegotiation/SSPI_Server/SSPI_Server/SSPI_Server.vcxproj
================================================
Debug
Win32
Release
Win32
Debug
x64
Release
x64
15.0
{0F287824-4459-459B-BD6B-7D206600132F}
Win32Proj
SSPIServer
10.0.17763.0
Application
true
v141
Unicode
Application
false
v141
true
Unicode
Application
true
v141
Unicode
Application
false
v141
true
Unicode
true
true
false
false
Use
Level3
Disabled
true
WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
false
Console
true
C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\lib;%(AdditionalLibraryDirectories)
Use
Level3
Disabled
true
_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
Use
Level3
MaxSpeed
true
true
true
WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
true
true
Use
Level3
MaxSpeed
true
true
true
NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
true
true
Create
Create
Create
Create
================================================
FILE: ImpersonateNtlmNegotiation/SSPI_Server/SSPI_Server/SSPI_Server.vcxproj.filters
================================================
{4FC737F1-C7A5-4376-A066-2A32D752A2FF}
cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx
{93995380-89BD-4b04-88EB-625FBE52EBFB}
h;hh;hpp;hxx;hm;inl;inc;ipp;xsd
{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
Header Files
Header Files
Source Files
Source Files
================================================
FILE: ImpersonateNtlmNegotiation/SSPI_Server/SSPI_Server/SSPI_Server.vcxproj.user
================================================
================================================
FILE: ImpersonateNtlmNegotiation/SSPI_Server/SSPI_Server/SspiExample.h
================================================
#pragma once
#pragma once
// SspiExample.h
#include
#include
BOOL SendMsg(SOCKET s, PBYTE pBuf, DWORD cbBuf);
BOOL ReceiveMsg(SOCKET s, PBYTE pBuf, DWORD cbBuf, DWORD *pcbRead);
BOOL SendBytes(SOCKET s, PBYTE pBuf, DWORD cbBuf);
BOOL ReceiveBytes(SOCKET s, PBYTE pBuf, DWORD cbBuf, DWORD *pcbRead);
void cleanup();
BOOL GenClientContext(
BYTE *pIn,
DWORD cbIn,
BYTE *pOut,
DWORD *pcbOut,
BOOL *pfDone,
CHAR *pszTarget,
CredHandle *hCred,
struct _SecHandle *hcText
);
BOOL GenServerContext(
BYTE *pIn,
DWORD cbIn,
BYTE *pOut,
DWORD *pcbOut,
BOOL *pfDone,
BOOL fNewCredential
);
BOOL EncryptThis(
PBYTE pMessage,
ULONG cbMessage,
BYTE ** ppOutput,
LPDWORD pcbOutput,
ULONG securityTrailer
);
PBYTE DecryptThis(
PBYTE achData,
LPDWORD pcbMessage,
struct _SecHandle *hCtxt,
ULONG cbSecurityTrailer
);
BOOL
SignThis(
PBYTE pMessage,
ULONG cbMessage,
BYTE ** ppOutput,
LPDWORD pcbOutput
);
PBYTE VerifyThis(
PBYTE pBuffer,
LPDWORD pcbMessage,
struct _SecHandle *hCtxt,
ULONG cbMaxSignature
);
void PrintHexDump(DWORD length, PBYTE buffer);
BOOL ConnectAuthSocket(
SOCKET *s,
CredHandle *hCred,
struct _SecHandle *hcText
);
BOOL CloseAuthSocket(SOCKET s);
BOOL DoAuthentication(SOCKET s);
void MyHandleError(char *s);
================================================
FILE: ImpersonateNtlmNegotiation/SSPI_Server/SSPI_Server.sln
================================================
Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio 15
VisualStudioVersion = 15.0.28010.0
MinimumVisualStudioVersion = 10.0.40219.1
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "SSPI_Server", "SSPI_Server\SSPI_Server.vcxproj", "{0F287824-4459-459B-BD6B-7D206600132F}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|x64 = Debug|x64
Debug|x86 = Debug|x86
Release|x64 = Release|x64
Release|x86 = Release|x86
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{0F287824-4459-459B-BD6B-7D206600132F}.Debug|x64.ActiveCfg = Debug|x64
{0F287824-4459-459B-BD6B-7D206600132F}.Debug|x64.Build.0 = Debug|x64
{0F287824-4459-459B-BD6B-7D206600132F}.Debug|x86.ActiveCfg = Debug|Win32
{0F287824-4459-459B-BD6B-7D206600132F}.Debug|x86.Build.0 = Debug|Win32
{0F287824-4459-459B-BD6B-7D206600132F}.Release|x64.ActiveCfg = Release|x64
{0F287824-4459-459B-BD6B-7D206600132F}.Release|x64.Build.0 = Release|x64
{0F287824-4459-459B-BD6B-7D206600132F}.Release|x86.ActiveCfg = Release|Win32
{0F287824-4459-459B-BD6B-7D206600132F}.Release|x86.Build.0 = Release|Win32
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {F2CED5A8-F349-4ADF-ACE5-D9171A54E248}
EndGlobalSection
EndGlobal
================================================
FILE: ImpersonationPipeLine/NamedPipeClient/NamedPipeClient/NamedPipeClient.vcxproj
================================================
Debug
Win32
Release
Win32
Debug
x64
Release
x64
15.0
{CFB43636-5FE4-4630-A4E6-D38594B5528C}
Win32Proj
NamedPipeClient
10.0.17763.0
Application
true
v141
Unicode
Application
false
v141
true
Unicode
Application
true
v141
Unicode
Application
false
v141
true
Unicode
true
true
false
false
Use
Level3
Disabled
true
WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
false
Console
true
C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\lib;%(AdditionalLibraryDirectories)
Use
Level3
Disabled
true
_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
Use
Level3
MaxSpeed
true
true
true
WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
true
true
Use
Level3
MaxSpeed
true
true
true
NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
true
true
Create
Create
Create
Create
================================================
FILE: ImpersonationPipeLine/NamedPipeClient/NamedPipeClient/NamedPipeClient.vcxproj.filters
================================================
{4FC737F1-C7A5-4376-A066-2A32D752A2FF}
cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx
{93995380-89BD-4b04-88EB-625FBE52EBFB}
h;hh;hpp;hxx;hm;inl;inc;ipp;xsd
{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
Header Files
Source Files
Source Files
================================================
FILE: ImpersonationPipeLine/NamedPipeClient/NamedPipeClient/NamedPipeClient.vcxproj.user
================================================
================================================
FILE: ImpersonationPipeLine/NamedPipeClient/NamedPipeClient.sln
================================================
Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio 15
VisualStudioVersion = 15.0.28010.0
MinimumVisualStudioVersion = 10.0.40219.1
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "NamedPipeClient", "NamedPipeClient\NamedPipeClient.vcxproj", "{CFB43636-5FE4-4630-A4E6-D38594B5528C}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|x64 = Debug|x64
Debug|x86 = Debug|x86
Release|x64 = Release|x64
Release|x86 = Release|x86
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{CFB43636-5FE4-4630-A4E6-D38594B5528C}.Debug|x64.ActiveCfg = Debug|x64
{CFB43636-5FE4-4630-A4E6-D38594B5528C}.Debug|x64.Build.0 = Debug|x64
{CFB43636-5FE4-4630-A4E6-D38594B5528C}.Debug|x86.ActiveCfg = Debug|Win32
{CFB43636-5FE4-4630-A4E6-D38594B5528C}.Debug|x86.Build.0 = Debug|Win32
{CFB43636-5FE4-4630-A4E6-D38594B5528C}.Release|x64.ActiveCfg = Release|x64
{CFB43636-5FE4-4630-A4E6-D38594B5528C}.Release|x64.Build.0 = Release|x64
{CFB43636-5FE4-4630-A4E6-D38594B5528C}.Release|x86.ActiveCfg = Release|Win32
{CFB43636-5FE4-4630-A4E6-D38594B5528C}.Release|x86.Build.0 = Release|Win32
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {0C852107-1C2D-4ED7-B1C7-A599EFD80F82}
EndGlobalSection
EndGlobal
================================================
FILE: ImpersonationPipeLine/NamedPipeServer/NamedPipeServer/NamedPipeServer.vcxproj
================================================
Debug
Win32
Release
Win32
Debug
x64
Release
x64
15.0
{269A4535-78A0-4736-ABFB-B944F625CC53}
Win32Proj
NamedPipeServer
10.0.17763.0
Application
true
v141
Unicode
Application
false
v141
true
Unicode
Application
true
v141
Unicode
Application
false
v141
true
Unicode
true
true
false
false
Use
Level3
Disabled
true
WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
false
Console
true
C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\lib;%(AdditionalLibraryDirectories)
Use
Level3
Disabled
true
_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
Use
Level3
MaxSpeed
true
true
true
WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
true
true
Use
Level3
MaxSpeed
true
true
true
NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
pch.h
Console
true
true
true
Create
Create
Create
Create
================================================
FILE: ImpersonationPipeLine/NamedPipeServer/NamedPipeServer/NamedPipeServer.vcxproj.filters
================================================
{4FC737F1-C7A5-4376-A066-2A32D752A2FF}
cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx
{93995380-89BD-4b04-88EB-625FBE52EBFB}
h;hh;hpp;hxx;hm;inl;inc;ipp;xsd
{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
Header Files
Source Files
Source Files
================================================
FILE: ImpersonationPipeLine/NamedPipeServer/NamedPipeServer/NamedPipeServer.vcxproj.user
================================================
================================================
FILE: ImpersonationPipeLine/NamedPipeServer/NamedPipeServer.sln
================================================
Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio 15
VisualStudioVersion = 15.0.28010.0
MinimumVisualStudioVersion = 10.0.40219.1
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "NamedPipeServer", "NamedPipeServer\NamedPipeServer.vcxproj", "{269A4535-78A0-4736-ABFB-B944F625CC53}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|x64 = Debug|x64
Debug|x86 = Debug|x86
Release|x64 = Release|x64
Release|x86 = Release|x86
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{269A4535-78A0-4736-ABFB-B944F625CC53}.Debug|x64.ActiveCfg = Debug|x64
{269A4535-78A0-4736-ABFB-B944F625CC53}.Debug|x64.Build.0 = Debug|x64
{269A4535-78A0-4736-ABFB-B944F625CC53}.Debug|x86.ActiveCfg = Debug|Win32
{269A4535-78A0-4736-ABFB-B944F625CC53}.Debug|x86.Build.0 = Debug|Win32
{269A4535-78A0-4736-ABFB-B944F625CC53}.Release|x64.ActiveCfg = Release|x64
{269A4535-78A0-4736-ABFB-B944F625CC53}.Release|x64.Build.0 = Release|x64
{269A4535-78A0-4736-ABFB-B944F625CC53}.Release|x86.ActiveCfg = Release|Win32
{269A4535-78A0-4736-ABFB-B944F625CC53}.Release|x86.Build.0 = Release|Win32
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {E299369B-490F-47F1-9A2F-E0AE46615254}
EndGlobalSection
EndGlobal
================================================
FILE: LICENSE
================================================
MIT License
Copyright (c) 2019 Sina Karvandi
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
================================================
FILE: README.md
================================================
# Process-Magics
This is a collection of interesting codes about Windows Process creation.
## CriticalProcess
This program enables SeDebugPrivilege and then sets its own process as Windows Critical Process, if by any reason the process is killed or closed then as it's a critical process, a blue screen appears.
## EnumAllHandles
This program enumerates all the handles from all the processes using a call to the native API NtQuerySystemInformation.
## ImpersonateNtlmNegotiation
This program is a client-server example of how a server can impersonate client through SSPI connections using ImpersonateSecurityContext.
## ImpersonationPipeLine
This program is a client-server example of how a server can impersonate client through named pipe connections using ImpersonateNamedPipeClient.
## Bypass Sysmon With Updating Rules
This project aims to bypass Sysmon's "16. Sysmon config states change" by directly sending update IOCTL to Sysmon's driver and as a result, completely bypasses Sysmon.