Skip to content

Commit 0b00508

Browse files
committed
Added more examples
1 parent 5811c50 commit 0b00508

File tree

9 files changed

+1965
-135
lines changed

9 files changed

+1965
-135
lines changed

Makefile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@ clean:
2424

2525
%.exe : %.nim
2626
nim c $(NIMFLAGS) --app=console --cpu=amd64 --out=bin/$*_64.exe $<
27-
nim c $(NIMFLAGS) --app=console --cpu=i386 --out=bin/$*_32.exe $<
27+
#nim c $(NIMFLAGS) --app=console --cpu=i386 --out=bin/$*_32.exe $<
2828

2929
%.dll: %.nim
3030
nim c $(NIMFLAGS) --app=lib --nomain --cpu=amd64 --out=bin/$*_64.dll $<
31-
nim c $(NIMFLAGS) --app=lib --nomain --cpu=i386 --out=bin/$*_32.dll $<
31+
#nim c $(NIMFLAGS) --app=lib --nomain --cpu=i386 --out=bin/$*_32.dll $<

README.md

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,10 @@ My experiments in weaponizing [Nim](https://nim-lang.org/) for implant developme
4343
| --- | --- |
4444
| `pop_bin.nim` | Call `MessageBox` WinApi *without* using the Winim library |
4545
| `pop_winim_bin.nim` | Call `MessageBox` *with* the Winim libary |
46+
| `execute_assembly_bin.nim` | Hosts the CLR, reflectively executes .NET assemblies from memory |
47+
| `clr_host_sloppy_bin.nim` | Hosts the CLR by directly embedding C++ code, executes a .NET assembly from disk |
48+
| `named_pipe_client_bin.nim` | Named Pipe Client |
49+
| `named_pipe_server_bin.nim` | Named Pipe Server
4650
| `pop_winim_lib.nim` | Example of creating a Windows DLL with an exported `DllMain` |
4751
| `wmiquery_bin.nim` | Queries running processes and installed AVs using using WMI |
4852
| `shellcode_bin.nim` | Creates a suspended process and injects shellcode with `VirtualAllocEx`/`CreateRemoteThread`. Also demonstrates the usage of compile time definitions to detect arch, os etc..|
@@ -54,7 +58,6 @@ My experiments in weaponizing [Nim](https://nim-lang.org/) for implant developme
5458
| `excel_com_bin.nim` | Injects shellcode using the Excel COM object and Macros |
5559
| `keylogger_bin.nim` | Keylogger using `SetWindowsHookEx` |
5660
| `amsi_patch_bin.nim` | Patches AMSI out of the current process (**Bugged, but compiles. Help appreciated**) |
57-
| `clr_bin.nim` | Hosts the CLR and executes .NET assemblies (**WIP, help appreciated**) |
5861
| `amsi_patch_2_bin.nim` | Patches AMSI out of the current process using a different method (**WIP, help appreciated**) |
5962
| `excel_4_com_bin.nim` | Injects shellcode using the Excel COM object and Excel 4 Macros (**WIP**) |
6063

0 commit comments

Comments
 (0)