├── 1.Encrypt_shellcode ├── compile.bat ├── encrypt.cpp └── shellcode.h ├── LICENSE ├── POC1 ├── ReflectiveNtdll.gif ├── compile.bat ├── enc_shellcode.h ├── implant.cpp ├── win10-ntdll_22H2_19045-2486.h └── win11-ntdll_22H2_22621-1105.h ├── POC2 ├── ReflectiveNtdll_POC2.gif ├── compile.bat ├── enc_shellcode.h ├── img │ ├── EAT_ntdll.PNG │ ├── IAT_ntdll.PNG │ ├── IAT_ntdll_missing.PNG │ └── _IMAGE_EXPORT_DIRECTORY.PNG ├── implant.cpp ├── win10-ntdll_22H2_19045-2486.h └── win11-ntdll_22H2_22621-1105.h └── README.md /1.Encrypt_shellcode/compile.bat: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/reveng007/ReflectiveNtdll/HEAD/1.Encrypt_shellcode/compile.bat -------------------------------------------------------------------------------- /1.Encrypt_shellcode/encrypt.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/reveng007/ReflectiveNtdll/HEAD/1.Encrypt_shellcode/encrypt.cpp -------------------------------------------------------------------------------- /1.Encrypt_shellcode/shellcode.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/reveng007/ReflectiveNtdll/HEAD/1.Encrypt_shellcode/shellcode.h -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/reveng007/ReflectiveNtdll/HEAD/LICENSE -------------------------------------------------------------------------------- /POC1/ReflectiveNtdll.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/reveng007/ReflectiveNtdll/HEAD/POC1/ReflectiveNtdll.gif -------------------------------------------------------------------------------- /POC1/compile.bat: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/reveng007/ReflectiveNtdll/HEAD/POC1/compile.bat -------------------------------------------------------------------------------- /POC1/enc_shellcode.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/reveng007/ReflectiveNtdll/HEAD/POC1/enc_shellcode.h -------------------------------------------------------------------------------- /POC1/implant.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/reveng007/ReflectiveNtdll/HEAD/POC1/implant.cpp -------------------------------------------------------------------------------- /POC1/win10-ntdll_22H2_19045-2486.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/reveng007/ReflectiveNtdll/HEAD/POC1/win10-ntdll_22H2_19045-2486.h -------------------------------------------------------------------------------- /POC1/win11-ntdll_22H2_22621-1105.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/reveng007/ReflectiveNtdll/HEAD/POC1/win11-ntdll_22H2_22621-1105.h -------------------------------------------------------------------------------- /POC2/ReflectiveNtdll_POC2.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/reveng007/ReflectiveNtdll/HEAD/POC2/ReflectiveNtdll_POC2.gif -------------------------------------------------------------------------------- /POC2/compile.bat: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/reveng007/ReflectiveNtdll/HEAD/POC2/compile.bat -------------------------------------------------------------------------------- /POC2/enc_shellcode.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/reveng007/ReflectiveNtdll/HEAD/POC2/enc_shellcode.h -------------------------------------------------------------------------------- /POC2/img/EAT_ntdll.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/reveng007/ReflectiveNtdll/HEAD/POC2/img/EAT_ntdll.PNG -------------------------------------------------------------------------------- /POC2/img/IAT_ntdll.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/reveng007/ReflectiveNtdll/HEAD/POC2/img/IAT_ntdll.PNG -------------------------------------------------------------------------------- /POC2/img/IAT_ntdll_missing.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/reveng007/ReflectiveNtdll/HEAD/POC2/img/IAT_ntdll_missing.PNG -------------------------------------------------------------------------------- /POC2/img/_IMAGE_EXPORT_DIRECTORY.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/reveng007/ReflectiveNtdll/HEAD/POC2/img/_IMAGE_EXPORT_DIRECTORY.PNG -------------------------------------------------------------------------------- /POC2/implant.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/reveng007/ReflectiveNtdll/HEAD/POC2/implant.cpp -------------------------------------------------------------------------------- /POC2/win10-ntdll_22H2_19045-2486.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/reveng007/ReflectiveNtdll/HEAD/POC2/win10-ntdll_22H2_19045-2486.h -------------------------------------------------------------------------------- /POC2/win11-ntdll_22H2_22621-1105.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/reveng007/ReflectiveNtdll/HEAD/POC2/win11-ntdll_22H2_22621-1105.h -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/reveng007/ReflectiveNtdll/HEAD/README.md --------------------------------------------------------------------------------