st3rven

// Technique:
//   1. Use #pragma section to create a PE section with execute permissions
//   2. Place shellcode buffer in that section via __declspec(allocate)
//   3. Register a Vectored Exception Handler
//   4. Trigger EXCEPTION_INT_DIVIDE_BY_ZERO
//   5. VEH catches it, sets RIP -> shellcode, returns EXCEPTION_CONTINUE_EXECUTION
//
// No VirtualAlloc, no VirtualProtect, no CreateThread -- shellcode lives in
// a statically-linked executable section and runs on the faulting thread.
//

st3rven

#!/usr/bin/env python3
"""
M365 OSINT Reconnaissance Tool
Based on techniques from: https://dstreefkerk.github.io/2025-07-m365-email-osint-after-lockdown/

This script performs modern M365/Azure AD reconnaissance after Microsoft's lockdown of traditional
enumeration methods. It uses multiple validation techniques to discover organizational information
and attempts to infer MOERA domains.
"""

st3rven

#################################################################
#			reconFTW config file			#
#################################################################

# General values
tools=~/Tools   # Path installed tools
SCRIPTPATH="$( cd "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )" # Get current script's path
profile_shell=".$(basename $(echo $SHELL))rc" # Get current shell profile
reconftw_version=$(git rev-parse --abbrev-ref HEAD)-$(git describe --tags) # Fetch current reconftw version
generate_resolvers=false # Generate custom resolvers with dnsvalidator

st3rven

console.log("[*] SSL Pinning Bypasses");
console.log(`[*] Your frida version: ${Frida.version}`);
console.log(`[*] Your script runtime: ${Script.runtime}`);

/**
 * by incogbyte
 * Common functions 
 * thx apkunpacker, NVISOsecurity, TheDauntless
 * Remember that sslpinning can be custom, and sometimes u need to reversing using ghidra,IDA or something like that.
 * !!! THIS SCRIPT IS NOT A SILVER BULLET !!