Now let's obfuscate both SetLastError and GetLastError with Beep and GetACP (actually any api from kernel32 will be ok even if it's not imported at all).
The used configurations are
[kernel32.dll]
SetLastError=Beep
GetLastError=GetACP Here is the output (also you can use the library directly as shown above).
The used configurations are
[kernel32.dll]
SetLastError=Beep
GetLastError=GetACP Here is the output (also you can use the library directly as shown above).
Again let's have a look on the kernel32 imports
There's no existence of SetLastError or GetLastError
A confirmation that two files will work properly
A confirmation that two files will work properly
Impact
IDA HexRays Decompiler
IDA HexRays Decompiler
That's because all of the static analysis (https://www.kitploit.com/search/label/Static%20Analysis) tool depend on what is the api name written at IAT which can be manipulated as shown.
For ApiMonitor, because of using IAT hooking, the same problem exists.
On the other side, for tools like x64dbg the shown api names will only depend on what is actually called (not what written at the IAT).
For ApiMonitor, because of using IAT hooking, the same problem exists.
On the other side, for tools like x64dbg the shown api names will only depend on what is actually called (not what written at the IAT).
Additional
Dumping the obfuscated PE out from memory won't deobfuscate (https://www.kitploit.com/search/label/Deobfuscate) it, because the manipulated IAT will be the same.
The main purpose for this tool is to mess up with the analysis process (make it slower).
One can obfuscate any imported symbol (by name or by ordinal) with another symbol (name or ordinal).
The shellcode is executed as the first tls callback to process the obfuscated symbols needed by the other tls callbacks before the entry point is executed.
The shellcode is shipped as c code, generated when the tool is compiled to facilitate editing it.
The obfuscated symbols names are being resolved by hash not by name directly.
The tool disables the relocations and strips any of the debug symbols.
The tool creates a new rwx section named .cobf for holding the shellcode and the other needed datas.
It can be used multiple times on the same obfuscated PE.
Tested only on Windows 10 (https://www.kitploit.com/search/label/Windows%2010) x64.
Get source with git clone https://github.com/d35ha/CallObfuscator.
Download binaries from the Release Section (https://github.com/d35ha/CallObfuscator/releases).
TODO
Shellcode obfuscation (https://www.kitploit.com/search/label/Obfuscation) (probably with obfusion (https://github.com/kgretzky/obfusion)). Support the delay-loaded symbols. Minimize the created section size. Compile time hashing. Better testing.
Download CallObfuscator (https://github.com/d35ha/CallObfuscator)
Dumping the obfuscated PE out from memory won't deobfuscate (https://www.kitploit.com/search/label/Deobfuscate) it, because the manipulated IAT will be the same.
The main purpose for this tool is to mess up with the analysis process (make it slower).
One can obfuscate any imported symbol (by name or by ordinal) with another symbol (name or ordinal).
The shellcode is executed as the first tls callback to process the obfuscated symbols needed by the other tls callbacks before the entry point is executed.
The shellcode is shipped as c code, generated when the tool is compiled to facilitate editing it.
The obfuscated symbols names are being resolved by hash not by name directly.
The tool disables the relocations and strips any of the debug symbols.
The tool creates a new rwx section named .cobf for holding the shellcode and the other needed datas.
It can be used multiple times on the same obfuscated PE.
Tested only on Windows 10 (https://www.kitploit.com/search/label/Windows%2010) x64.
Get source with git clone https://github.com/d35ha/CallObfuscator.
Download binaries from the Release Section (https://github.com/d35ha/CallObfuscator/releases).
TODO
Shellcode obfuscation (https://www.kitploit.com/search/label/Obfuscation) (probably with obfusion (https://github.com/kgretzky/obfusion)). Support the delay-loaded symbols. Minimize the created section size. Compile time hashing. Better testing.
Download CallObfuscator (https://github.com/d35ha/CallObfuscator)
hacking: security in practice
Are there any apps/programs to heatmap/triangulate wifi?
I suppose the title says it all. I've wondered if theres an app that lets you heatmap or locate wifi clients and base stations by moving your laptop or phone around.
submitted by /u/ultimaIV
[link] [comments]
Are there any apps/programs to heatmap/triangulate wifi?
I suppose the title says it all. I've wondered if theres an app that lets you heatmap or locate wifi clients and base stations by moving your laptop or phone around.
submitted by /u/ultimaIV
[link] [comments]
reddit
Are there any apps/programs to heatmap/triangulate wifi?
I suppose the title says it all. I've wondered if theres an app that lets you heatmap or locate wifi clients and base stations by moving your...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Hack The Box — Sunday: Walkthrough (without Metasploit)
https://cdn-images-1.medium.com/max/600/1*WtYaTxfrUMLzrOfP0b-9ag.png
Hack The Box — Sunday: Walkthrough (without Metasploit) | Road to OSCP | Solaris Easy Level | Finger enumeration | SSH key exchange method
Continue reading on Medium »
Hack The Box — Sunday: Walkthrough (without Metasploit)
https://cdn-images-1.medium.com/max/600/1*WtYaTxfrUMLzrOfP0b-9ag.png
Hack The Box — Sunday: Walkthrough (without Metasploit) | Road to OSCP | Solaris Easy Level | Finger enumeration | SSH key exchange method
Continue reading on Medium »