cyber-security-resources/exploit_development/README.md

Exploit Development References

Tutorials and Examples

• Shellcode Tutorial
• Shellcode Examples
• Exploit Writing Tutorials
• Exploit Exercises

Hex Editors

• HexEdit.js - Browser-based hex editing.
• Hexinator - World's finest (proprietary, commercial) Hex Editor.
• Frhed - Binary file editor for Windows.
• 0xED - Native macOS hex editor that supports plug-ins to display custom data types.

File Format Analysis Tools

• Kaitai Struct - File formats and network protocols dissection language and web IDE, generating parsers in C++, C#, Java, JavaScript, Perl, PHP, Python, Ruby.
• Veles - Binary data visualization and analysis tool.
• Hachoir - Python library to view and edit a binary stream as tree of fields and tools for metadata extraction.

Reverse Engineering Tools

The following are some of the most popular reverse engineering tools. HOWEVER! GO TO THE REVERSE ENGINEERING SECTION for more references.

• Interactive Disassembler (IDA Pro) - Proprietary multi-processor disassembler and debugger for Windows, GNU/Linux, or macOS; also has a free version, IDA Free.
• WDK/WinDbg - Windows Driver Kit and WinDbg.
• OllyDbg - x86 debugger for Windows binaries that emphasizes binary code analysis.
• Radare2 - Open source, crossplatform reverse engineering framework.
• x64dbg - Open source x64/x32 debugger for windows.
• Immunity Debugger - Powerful way to write exploits and analyze malware.
• Evan's Debugger - OllyDbg-like debugger for GNU/Linux.
• Medusa - Open source, cross-platform interactive disassembler.
• plasma - Interactive disassembler for x86/ARM/MIPS. Generates indented pseudo-code with colored syntax code.
• peda - Python Exploit Development Assistance for GDB.
• dnSpy - Tool to reverse engineer .NET assemblies.
• binwalk - Fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images.
• PyREBox - Python scriptable Reverse Engineering sandbox by Cisco-Talos.
• Voltron - Extensible debugger UI toolkit written in Python.
• Capstone - Lightweight multi-platform, multi-architecture disassembly framework.
• rVMI - Debugger on steroids; inspect userspace processes, kernel drivers, and preboot environments in a single tool.
• Frida - Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers.

Implant Creation

• Exploiting CVE-2017-0199: HTA Handler Vulnerability
• CVE-2017-0199 Toolkit
• CVE-2017-8759-Exploit-sample
• Window Signed Binary
• Wepwnise
• Bash Bunny
• Generate Macro - Tool
• How To: Empire’s Cross Platform Office Macro
• Excel macros with PowerShell
• PowerPoint and Custom Actions
• MS Signed mimikatz in just 3 steps
• Hiding your process from sysinternals
• Luckystrike: An Evil Office Document Generator
• The Absurdly Underestimated Dangers of CSV Injection
• Macro-less Code Exec in MSWord
• Multi-Platform Macro Phishing Payloads
• Macroless DOC malware that avoids detection with Yara rule
• Empire without powershell
• Powershell without Powershell to bypass app whitelist
• Phishing between the app whitelists
• Bypass Application Whitelisting Script Protections - Regsvr32.exe & COM Scriptlets (.sct files)
• Bypassing Application Whitelisting using MSBuild.exe - Device Guard Example and Mitigations
• Windows oneliners to download remote payload and execute arbitrary code
• Week of Evading Microsoft ATA - Announcement and Day 1 to Day 5
• AMSI How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It
• USING A SCF FILE TO GATHER HASHES
• USING THE DDE ATTACK WITH POWERSHELL EMPIRE
• AVSignSeek
• Keying Payloads for Scripting Languages
• Executing Metasploit & Empire Payloads from MS Office Document Properties (part 1 of 2)
• Executing Metasploit & Empire Payloads from MS Office Document Properties (part 2 of 2)
• Microsoft Office – NTLM Hashes via Frameset
• Abusing Microsoft Word Features for Phishing: “subDoc”
• code signing certificate cloning attacks and defenses
• userland api monitoring and code injection detection
• In memory evasion