cocomelonc

Cybersecurity research results. Simple C/C++ and Python implementations

It bridges my research with a functional tool. I want to provide a safe, open-source framework for hackers to test evasion and for defenders to improve detection through hands-on learning.

BSides Prishtina 2024 Malware Development and Persistence workshop

Cybersecurity blog. Red Team, pentest, malware analysis and dev

The result of research and investigation of malware development tricks, techniques, evasion, cryptography and linux malware

some eJPT exam preparation notes

a minimal, position-independent C shellcode framework for Windows x64. compiles entirely on Linux

Malware AV evasion via disable Windows Defender (Registry). C++

Vulnerabilities exploitation examples, python

Proof of Concept example for abusing Process Hacker 2 (v2.39.124)

Find kernel32 base and API addresses. Simple C++ implementation

OFFZONE 2024 Malware Persistence workshop

Attack and introduction (info stealer), start your adventure in MMD

Run payload like a Lazarus Group (UuidFromStringA). C++ implementation

Transmit malware payload via sound: DFT + FSK + Goertzel algorithm + IDFT

Code injection via ZwCreateSection, ZwUnmapViewOfSection. C++ example

Malware persistence via COM DLL hijacking. C++ implementation example

AV engines evasion for C++ simple malware part 1 source code

Run shellcode via EnumDesktopsA. C++ implementation

Process injection via KernelCallbackTable

This repo contains C/C++ snippets that can be handy in specific offensive scenarios.

Malware dev. Run shellcode via EnumChildWindows. C++ implementation

Malware development: persistence - part 1: startup folder registry keys. C++ implementation

Malware dev tricks: parent PID spoofing. C++ implementation

Code injection via memory sections (Zw) and ZwQueueApcThread. C++ malware example

Classic DLL injection. Download dll from url and inject. Simple C++ implementation

Malware dev tricks - part 33. Syscalls part 2. Simple C++ PoC example

Malware dev tricks. Syscalls part 1. Simple C example

AV evasions part 4. Trick with hide API calls via ordinals. Simple C++ example

Malware dev persistence part 10: via Image File Execution Options. C++ implementation

APT techniques: Token theft via UpdateProcThreadAttribute. C++ implementation

Windows persistence via screensavers. Simple C++ implementation

Malware dev trick part 31. Simple C++ PoC

Venom is a library that meant to perform evasive communication using stolen browser socket

AV evasion part 5. C++ implementation

Malware AV evasion trick: payload encoding via Z85 algorithm. C++ implementation

Malware AV evasion via RC4 encrypt. C++ example

Malware persistent trick. Winlogon registry keys. C++ implementation

C++ classic code injection example. Source code of my post

Malware AV/VM evasion part 15: GetModuleHandle: simple implementation

Malware dev tricks: part 30. Find pid NtGetNextProcess. Simple C++ implementation

Malware dev tricks: part 29. Fileless storage - Registry. C++ implementation

Code injection via NtOpenProcess and NtAllocateVirtualMemory

Malware development persistence part 4. Simple C++ example

Malware persistence part 6. Via Netsh helper DLL. C++ implementation

Malware persistence via Port Monitors. C++ implementation

Malware persistence via change default file association. C++ malware example

Malawre development persistence: part 16. C++ implementation

Source code of my post about reverse shells

Linux x86-64 syscall tracer written in C with a small assembly support layer

Malware dev tricks: part 28. C++ example (PoC)

Malware persistence part 19. Simple C++ implementation

Malware persistence via CLSID extension handling. C++ implementation

simple C++ windows reverse shell with AES encryption (command) example

Find kernel32.dll base address via ASM

DLL injection to another process via undocumented NtCreateThreadEx

AV evasion techniques - part 3. Simple C++ malware

Basic API hooking via push/retn method. Simple C++ example

Simple payload injection logic via FindWindow. Classic process injection impl C++

AV/VM evasion techniques part 6. C++ implementation

Malware AV/VM evasion: anti-debugging. NtGlobalFlag. C++ implementation

Windows access token manipulation. C++ implementation example

Malware development: persistence - part 13. C++ implementation example

Malware analysis part 6. Shannon entropy

Malware dev tricks: part 24. ListPlanting. C++ implementation example

Ransomware simulation PoC for different cryptographic algorithms

Welcome to the page where you will find each trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news.

Malware dev: persistence - part 5. AppInitDLLs. C++ implementation

Malware AV evasion - part 14. Encryption/decryption via A5/1

Classic DLL injection to remote process. C++ source code

Source code of DLL hijacking in windows. Proof of Concept. Simple C example

Linux shellcoding tutorial with examples

DLL hijacking with exported functions

Classic DLL injection via SetWindowsHookEx. Simple C++ example

Code injection via Windows Fibers. Simple C++ example

Code injection via undocumented NtAllocateVirtualMemory

Code injection via utilizing sections for malicious code execution

Process injection via hunting RWX memory. C++ malware

Malware analysis part 4. Simple python script to upload file to VirusTotal and get info about result of analysis

Malware persistence part 11. Powershell profile. C++ implementation example

Malware dev - persistence part 14. C++ implementation example

Malware persistence part 15: IE. C++ implementation

Malware persistence part 18. Simple C++ implementation

Malware development tricks part 25. Simple C++ implementation

Malware AV evasion via Madryga algorithm encryption. C++ implementation

APC code injection technique example. C++

kill anti-malware protected processes (BYOVD)

Is a tool created to evade AVs and EDRs or security tools.

Malware development tricks 27. LoadLibrary implementation

AV/VM evsaion part 16. C++ example

AV engines evasion for C++ simple malware part 2

NASM tutorial. Malware analysis part 2

APC injection via Queue an APC into all the threads

Code injection via thread hijacking. C++ malware example

Classic 5-byte hook example. C++

C++ simple injector with findMyProc function which find process by name and inject DLL to it

Threat hunting with YARA. Simple malware example and YARA rule. C++

Malware persistence - part 12. via Accessibility Features. C++ implementation

Malware analysis part 7. YARA rule for CRC32 hash. Simple implementation of part of the REvil ransomware's logic

A small, self-contained C implementation of Shamir's Secret Sharing (Adi Shamir, 1979) over GF(2^8)

Intoduction to malware analysis. Begin x86 assembly lang crash course with examples.

Linux shellcoding part 2: Reverse TCP shell

Classic stack buffer overflow exploitation

Windows shellcoding part1. Simplest examples in C/C++

APC injection via undocumented NtTestAlert

Run shellcode via inline ASM. C++ example

Basic memory forensics with Volatility 3. Simple example - classic process injection

Persistence via UserInitMprLogonScript key value. Simple C++ implementation

Malware analysis - part 8: MurmurHash2. C++ implementation

Malware AV evasion - part 12. encrypt payload with TEA. C++ implementation

Malware AV evasion part 11. DES encryption. C++ implementation.

My own writeups for https://nrzctf.kz

a minimalist micro TI / SOC context panel powered by local AI + Malpedia API

Meow-meow messagebox shellcode

CVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit

Malware dev tricks: part 26. Mutexes. C++ implementation

Strategy game. Gamedev for childs

Test tool for CVE-2020-1472

Tiny cross-platform encrypted vault for DEFCON Demo Labs, trainings and workshops (demo).

Python pygame project from my course "game dev for kids"

Ghidra is a software reverse engineering (SRE) framework

No description.