What is the primary purpose of building custom payloads using raw shellcode instead of using ready-to-run payloads from C2 frameworks?
It is beneficial in situations like initial access where custom payloads may evade defenses more effectively.
What is the Portable Executable (PE) file format?
It’s a file format for executables and DLLs that holds information necessary for the operating system to load a program into memory.
What is the fixed size of the DOS header (IMAGE_DOS_HEADER) at the start of every PE file?
The DOS header is a fixed 64-byte structure.
What is the constant 2-byte value found in the ‘e_magic’ member of the DOS header, and what does it represent in ASCII?
The value is ‘4D 5A’, which represents ‘MZ’ in ASCII, serving as a signature for the PE file.
Which member of the DOS header contains an offset to the PE signature at the start of the NT headers?
The ‘e_lfanew’ member.
At what fixed offset from the start of a PE file is the ‘e_lfanew’ member located?
It is always located at an offset of ‘3C’ (60 in decimal).
What is the primary function of the DOS stub in a modern Windows environment?
The modern Windows loader uses the offset in ‘e_lfanew’ to skip over the stub and go directly to the NT headers.
The constant 4-byte value ‘50 45 00 00’ (‘PE\0\0’) at the beginning of the NT headers is known as the _____.
PE signature
In the PE file header (IMAGE_FILE_HEADER), what does the ‘Machine’ member indicate?
It indicates the CPU architecture the PE file is compiled for.
What information is held in the ‘NumberOfSections’ member of the PE file header?
It holds the total number of sections the PE file has.
Which member of the Optional Header determines if a PE image is 32-bit (PE32) or 64-bit (PE32+)?
The ‘Magic’ member.
What does the ‘AddressOfEntryPoint’ member in the Optional Header specify?
It specifies the address of the PE’s entry point relative to the image base when loaded into memory.
What is the ‘ImageBase’ in the Optional Header?
It is the preferred base address for the PE image to be loaded into memory.
The _____ contains information needed by the Windows loader, such as details of the DLLs that a PE requires to function.
import directory
Which PE section typically contains the executable code of the program?
The ‘.text’ section.
Which PE section contains resources used by a program, such as icons and images?
The ‘.rsrc’ section.
In a section header, what is the difference between ‘VirtualSize’ and ‘SizeOfRawData’?
‘VirtualSize’ is the total size of the section in memory, while ‘SizeOfRawData’ is its size on disk, which may differ due to padding.
What do the ‘Characteristics’ in a PE section header describe?
They are a set of flags that describe attributes of the section, including its final memory permissions (e.g., R, RW, RX).
Distinguish between a ‘program’ and a ‘process’.
A program is a compiled PE file, while a process is a container that holds the resources for a running instance of that program.
Which Windows API is the simplest way to create a new process that has the same access token as the caller?
CreateProcessW.
Ultimately, process creation APIs like CreateProcessW and CreateProcessAsUserW call into which kernel function?
NtCreateUserProcess.
What is a thread in the context of the Windows OS?
A thread is an object that Windows schedules for execution within a process, holding the CPU state and a call stack.
Which API creates a new thread within the calling process’s address space?
CreateThread.
To create a new thread in a different process, which API would you use?
CreateRemoteThread.
-
Module 144
-
Module 243
-
Module 360
-
Module 466
-
Module 550
-
Module 660
-
Module 762
-
Module 856
-
Module 918
-
Module 1052
-
Module 1153
-
Module 1250
-
Module 1336
-
Module 1441
-
Module 1567
-
Module 1653
-
Module 1728
-
Module 1851
-
Module 1954
-
Module 2022
-
Cobalt Strike User Guide161
-
Cobalt Strike Installation Guide37
