update doc

docs/en/module/Execution_UserExecution_NtCreateSection.md

@@ -1,7 +1,10 @@
-# NtCreateSection Process Injection (wait)
+# NtCreateSection Process Injection
 
-
-XXX
+Inject shellcode into explorer.exe process using NtCreateSection technique
 
 ## Operation Method
-+ XXX
+
++ Create a new listener (Linux)
++ Open the module and select the corresponding listener
++ After running the module, a zip file will be generated in `File Management`, containing C++ code
++ You can customize and compile the source code using Visual Studio

docs/en/module/Execution_UserExecution_Syscall_Inject.md

@@ -0,0 +1,15 @@
+# Direct Windows System Call Evasion Technique
+
+This module allows you to generate payloads that evade host-based (endpoint) security products such as EDR/AVs. The module uses direct Windows system calls to achieve stealth and
+avoid EDR hooks. Please use HTTPS and RC4 type listeners to evade traffic detection devices.
+
+## Operation Method
+
++ Create a new listener
++ Open the module and select the corresponding listener
++ After running the module, a zip file will be generated in `File Management`, containing C++ code
++ You can customize and compile the source code using Visual Studio
+
+## Notes
+
++ To increase the evasion success rate, it is recommended to use high sleep values.

docs/en/module/Execution_UserExecution_VSSyscallProject.md

@@ -1,9 +1,9 @@
 # Visual Studio Project for Syscall
 
-
-A VS project that includes the basic usage of syscall and encrypted shellcode.
+A VS project that includes basic usage of syscall and encrypted shellcode
 
 ## Operation Method
-- Create a new listener.
-- Open the module and select the corresponding listener.
-- After running the module, a zip file will be generated in `File Management`, which contains all the files of the VS project.
+
++ Create a new listener
++ Open the module and select the corresponding listener
++ After running the module, a zip file will be generated in `File Management`, containing all the files of the VS project

docs/en/module/PrivilegeEscalation_BypassUserAccountControl_Windows.md

@@ -1,32 +1,31 @@
 # Windows UAC Bypass
 
+Built-in multiple methods to bypass system UAC to obtain administrator privileges.
 
-Built-in with multiple methods to bypass the system UAC and obtain administrator privileges.
++ Automatic Mode: Automatically select bypass technique and execute
++ Manual Mode: Manually select a specific bypass technique and execute
++ Detection Mode: Automatically detect which bypass techniques are suitable for the Session (without execution)
 
-+ Automatic Mode: Automatically select the bypass technique and execute.
-+ Manual Mode: Manually select a certain bypass technique and execute.
-+ Detection Mode: Automatically detect which bypass techniques are applicable to the Session (without execution)
+## Notes
 
++ The module requires Session integrity level to be medium or above and be in the administrators group
++ Automatic mode will run multiple sub-modules to attempt UAC bypass, which may be blocked by antivirus software
++ It is recommended to use detection mode to get the list of applicable sub-modules, then run them manually one by one
 
+## Operation Method
 
-# Note
-+ The module requires the Session integrity privilege to be at medium or above and be in the administrator group.
-+ The automatic mode will run multiple sub-modules to attempt to BypassUAC, and anti-virus software may intercept.
-+ It is recommended to use the detection mode to obtain the list of applicable sub-modules, and then run them manually one by one.
-
-# Operating Methods
-+ Obtain the Session.
-+ View the Session information to confirm that **the Session integrity privilege is at medium or above**, **it is in the administrator group, and the UAC level is the default**.
++ Get Session
++ Check Session information, confirm Session integrity level is medium or above, in administrators group, and UAC level is default
 
 ![](img/PrivilegeEscalation_BypassUserAccountControl_Windows/1.webp)
 
-+ Run the detection mode to view which modules are available.
++ Run detection mode to see which modules are available
 
 ![](img/PrivilegeEscalation_BypassUserAccountControl_Windows/2.webp)
 
 ![](img/PrivilegeEscalation_BypassUserAccountControl_Windows/3.webp)
 
-+ According to the detection results, run the sub-modules separately, or use the automatic mode.
++ Based on detection results, run sub-modules individually or use automatic mode
 
 ![](img/PrivilegeEscalation_BypassUserAccountControl_Windows/4.webp)
 

docs/en/module/PrivilegeEscalation_EnumPatchExample_Windows.md

@@ -1,13 +1,10 @@
-# Obtain Windows Patch List
+# Get Windows Patch List
 
-
-Obtain the patches currently installed on Windows
+Get the list of currently installed Windows patches.
 
 ## Operation Method
-+ Select the session
+
++ Select a session
 + Run the module
 
 ![](img\PrivilegeEscalation_EnumPatchExample_Windows\1.webp)
-
-# Note
-This module is mainly used to demonstrate how to call Metasploit Framework (MSF) modules within Viper modules.

docs/en/module/PrivilegeEscalation_ExploitationForPrivilegeEscalation_CVE_2021_40449.md

@@ -1 +1,8 @@
-请你提供具体的中文markdown格式技术文档内容，以便我按要求进行翻译。 
+# CVE-2021-40449 Privilege Escalation
+
+The module uses CVE-2021-40449 to escalate privileges to system. The current module is compatible with Windows 10.
+
+## Operation Method
+
++ Select a listener
++ Run the module

docs/en/module/PrivilegeEscalation_ExploitationForPrivilegeEscalation_EfsPotato.md

@@ -1,6 +1,5 @@
 # EfsPotato Privilege Escalation
 
-
 Use EfsPotato.exe to escalate privileges. EfsPotato is generally used to escalate from service privileges to SYSTEM privileges, such as for IIS privilege escalation.
 
 ## Operation Method

docs/en/module/PrivilegeEscalation_ExploitationForPrivilegeEscalation_SweetPotato.md

@@ -11,22 +11,22 @@ Some IIS servers are launched using the ApplicationPoolIdentity user. This user
 The specific symptom is that commands can be executed using a webshell, but external executables cannot be executed.
 
 ## Operation Method
-- Take IIS privilege escalation as an example for illustration.
-- Add a listener and generate a payload.
-- Use a webshell to upload the payload to the target and execute it.
++ Take IIS privilege escalation as an example for illustration.
++ Add a listener and generate a payload.
++ Use a webshell to upload the payload to the target and execute it.
 
 ![](img/PrivilegeEscalation_ExploitationForPrivilegeEscalation_SweetPotato/1.webp)
 
 ![](img/PrivilegeEscalation_ExploitationForPrivilegeEscalation_SweetPotato/2.webp)
 
-- At this point, a Session with Network Service privileges is obtained.
++ At this point, a Session with Network Service privileges is obtained.
 
 ![](img/PrivilegeEscalation_ExploitationForPrivilegeEscalation_SweetPotato/3.webp)
 
-- Use the generated Session to run the module, and still fill in the payload uploaded before running as the parameter.
++ Use the generated Session to run the module, and still fill in the payload uploaded before running as the parameter.
 
 ![](img/PrivilegeEscalation_ExploitationForPrivilegeEscalation_SweetPotato/4.webp)
 
-- Run the module to obtain a SYSTEM privilege Session.
++ Run the module to obtain a SYSTEM privilege Session.
 
 ![](img/PrivilegeEscalation_ExploitationForPrivilegeEscalation_SweetPotato/5.webp)

docs/en/module/PrivilegeEscalation_ExploitationForPrivilegeEscalation_Windows.md

@@ -1,14 +1,16 @@
-# CVEs that can be exploited by the search system
+# Search for Exploitable System CVEs
 
-## Main functions
-Execute PowerShell scripts in memory to view system version information and patch information.
-Compare with the data in the database and filter out which CVE vulnerabilities the system may be affected by.
+Execute PowerShell scripts in memory to check system version information and patch information,
 
-## Note
-The module may output a large amount of CVE information. It is recommended to use it only as a reference.
+Compare with the database to filter which CVE vulnerabilities might affect the system
 
-## Operation methods
-- Obtain Session
-- Fill in parameters and execute the module
+## Notes
 
-![](img/PrivilegeEscalation_ExploitationForPrivilegeEscalation_Windows/1.webp)
+The module may output a large amount of CVE information, it should only be used as a reference
+
+## Operation Method
+
++ Get a Session
++ Fill in parameters and execute the module
+
+![](img\PrivilegeEscalation_ExploitationForPrivilegeEscalation_Windows\1.webp)

docs/en/module/PrivilegeEscalation_ProcessInjection_Getsystem.md

@@ -1,14 +1,15 @@
 # Windows System Privilege Escalation
 
+Attempt to obtain system privileges using multiple techniques
 
-Attempt to obtain system privileges using a variety of techniques.
+## Notes
 
-# Note
-This is not anti-detection. It is required that the Session has administrative privileges with UAC bypassed.
+This is not anti-detection. Requires a Session with administrative privileges and UAC already bypassed
 
 ## Operation Method
-+ Obtain the Session.
-+ Select the privilege escalation technique (automation is recommended).
-+ Run the module.
 
-![](img/PrivilegeEscalation_ProcessInjection_Getsystem/1.webp)
++ Get a Session
++ Select privilege escalation technique (automation recommended)
++ Run the module
+
+![](img\PrivilegeEscalation_ProcessInjection_Getsystem\1.webp)

docs/zh/module/Execution_UserExecution_NtCreateSection.md

@@ -1,10 +1,13 @@
-# NtCreateSection进程注入(wait)
+# NtCreateSection进程注入
 
-
-XXX
+通过NtCreateSection技术将shellcode注入到explorer.exe进程
 
 ## 操作方法
-+ XXX
+
++ 新建监听
++ 打开模块,选择对应的监听
++ 运行模块后即会在`文件管理`中生成一个zip文件,包含C++代码
++ 可使用visual studio自定义修改及编译源码
 
 
 

docs/zh/module/Execution_UserExecution_Syscall_Inject.md

@@ -0,0 +1,14 @@
+# 直接windows系统调用规避技术
+
+此模块允许您生成规避基于主机(终端)的安全产品，如EDR/AVs.模块使用直接windows系统调用以实现隐蔽性,并避免EDR hook.请使用HTTPS及RC4类型监听,以规避流量检测设备.
+
+## 操作方法
+
++ 新建监听
++ 打开模块,选择对应的监听
++ 运行模块后即会在`文件管理`中生成一个zip文件,包含C++代码
++ 可使用visual studio自定义修改及编译源码
+
+## 注意事项
+
++ 为了提高规避几率，建议使用高睡眠值.

docs/zh/module/Execution_UserExecution_VSSyscallProject.md

@@ -1,9 +1,9 @@
 # Syscall的Visual Studio工程
 
-
-一个VS工程,工程中包含syscall的基本使用方法及加密后的shellcode
+VS工程中包含syscall的基本使用方法及加密后的shellcode
 
 ## 操作方法
+
 + 新建监听
 + 打开模块,选择对应的监听
 + 运行模块后即会在`文件管理`中生成一个zip文件,包含VS工程的所有文件

docs/zh/module/PrivilegeEscalation_BypassUserAccountControl_Windows.md

@@ -1,22 +1,21 @@
 # Windows UAC绕过
 
-
 内置多种种方式绕过系统UAC获取管理员权限.
 
 + 自动模式:自动选择绕过技术并执行
 + 手动模式:手动选择某种绕过技术并执行
-+ 检测模式:自动检测Sesion适用哪些绕过技术(不执行)
-
-
++ 检测模式:自动检测Session适用哪些绕过技术(不执行)
 
 ## 注意事项
+
 + 模块需要Session完整性权限为中以上并处于管理员组.
 + 自动模式会运行多个子模块尝试BypassUAC,杀软会拦截.
 + 建议使用检测模式获取适用的子模块列表后,单独手工依次运行.
 
 ## 操作方法
+
 + 获取Session
-+ 查看Session信息,确认**Session完整性权限为中以上**** ,****处于管理员组,UAC等级为默认**
++ 查看Session信息,确认Session完整性权限为中以上,处于管理员组,UAC等级为默认
 
 ![](img\PrivilegeEscalation_BypassUserAccountControl_Windows\1.webp)
 

docs/zh/module/PrivilegeEscalation_EnumPatchExample_Windows.md

@@ -1,15 +1,14 @@
 # 获取Windows补丁列表
 
-
 获取Windows当前已安装补丁
 
 ## 操作方法
+
 + 选择session
 + 运行模块
 
 ![](img\PrivilegeEscalation_EnumPatchExample_Windows\1.webp)
 
-## 注意事项
-模块主要用来演示如何在Viper模块中调用msf模块
+
 
 

docs/zh/module/PrivilegeEscalation_ExploitationForPrivilegeEscalation_CVE_2021_40449.md

@@ -0,0 +1,8 @@
+# CVE-2021-40449提权
+
+模块使用CVE-2021-40449提权到system,当前模块适配Windows 10
+
+## 操作方法
+
++ 选择监听
++ 执行模块

docs/zh/module/PrivilegeEscalation_ExploitationForPrivilegeEscalation_EfsPotato.md

@@ -1,9 +1,9 @@
 # EfsPotato提权
 
-
 使用EfsPotato.exe进行提权.EfsPotato一般用于服务权限到SYSTEM权限,例如IIS的提权
 
 ## 操作方法
+
 + 选择监听
 + 执行模块
 

docs/zh/module/PrivilegeEscalation_ExploitationForPrivilegeEscalation_SweetPotato.md

@@ -1,16 +1,17 @@
 # SweetPotato提权
 
-
 模块使用SweetPotato.exe进行提权.
 
 SweetPotato要求有本地服务权限,如IIS的Network Service
 
 ## 注意事项
+
 部分IIS服务器是使用ApplicationPoolIdentity用户启动的,该用户为虚拟用户,无法提权.
 
 具体现象是使用webshell可以执行命令,但是无法执行外部exe.
 
 ## 操作方法
+
 + 以IIS提权为例说明
 + 新增监听,生成载荷
 + 使用webshell将载荷上传到目标并执行

docs/zh/module/PrivilegeEscalation_ExploitationForPrivilegeEscalation_Windows.md

@@ -1,14 +1,15 @@
 # 搜索系统可利用CVE
 
-
 通过内存执行powershell脚本查看系统版本信息及补丁信息,
 
 与数据库中的数据对比,删选系统可能受那些CVE漏洞影响
 
 ## 注意事项
+
 模块可能输出大量CVE信息,建议只作为参考
 
 ## 操作方法
+
 + 获取Session
 + 填写参数,执行模块
 

docs/zh/module/PrivilegeEscalation_ProcessInjection_Getsystem.md

@@ -1,12 +1,13 @@
 # Windows System提权
 
-
 尝试使用多种技术获取system权限
 
 ## 注意事项
+
 不免杀,要求Session为已绕过UAC的管理员权限
 
 ## 操作方法
+
 + 获取Session
 + 选择提权技术(建议为自动)
 + 运行模块