CLR-Unhook

CLR 언후킹 도구 참고: 깨끗한 CLR 효과를 보려면 디스크에서 DLL을 수동으로 메모리에 매핑해야 합니다. LoadLibraryA/W를 사용할 수 없습니다. 안티바이러스 솔루션이 DLL 로드 이벤트를 감지하고 즉시 후킹할 수 있기 때문입니다. 이 동작을 원한다면 GitHub에 있는 기존 수동 매퍼를 찾아 코드베이스에 통합할 수 있습니다. AV 업체들이 일반적으로 이를 좋아하지 않기 때문에 여기에는 포함하지 않았습니다. .NET 공용 언어 런타임에서 원래 nLoadImage 함수 구현을 복원하여 EDR/AV 후크를 우회하는...

mal_unpack

malunpack Dynamic unpacker based on PE-sieve 📖 Read more . It deploys a packed malware, waits for it to unpack the payload, dumps the payload, and kills the original process. !CAUTION This unpacker deploys the original malware. Use it only on a VirtualMachine. ⚙ Usage Basic usage: root@kitploit:...

execute-assembly-pico

Execute Assembly PICO Crystal Palace向けのPICOであり、donut シェルコードジェネレーターと同じ手法を使用して、追加された.NETアセンブリをメモリ内で実行するためのネイティブCLRホスティングを実装しています。これにより、RubeusやSeatbeltなどの.NETツールを、ディスク上に配置せずに位置独立コードから読み込むことができます。 ビルド プロジェクトをリンクするには、MinGW GCC、zipユーティリティ、およびCPL実行ファイルが必要です。config.spec...

RogueAssemblyHunter

. . \ / \ | | | .. | // \ / | | / \ / / \ \ / // // \ / | | | // | /\ / / | \ \ \ /| Y Y \ \ \ | | || // /|/ | / || / // | / // / / / / / / / / / | \ / | / \ | / \ / \ Y / | / | \ | \ /| | / | /|/|| /| | / / / Rogue Assembly Hunter Rogue Assembly Hunter는 실행 중인 프로세스에서 '흥미로운' .NET CLR 모듈을 발견하기 위한...

ViperSoftX Malware Disguises as eBooks on Torrents to Spread Stealthy Attacks

The sophisticated malware known as ViperSoftX has been observed being distributed as eBooks over torrents. "A notable aspect of the current variant of ViperSoftX is that it uses the Common Language Runtime CLR to dynamically load and run PowerShell commands, thereby creating a PowerShell...

ALSA-2024:4450 Important: dotnet8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.107 and Runtime 8.0.7. Security...

D-Link DKVM-IP8 - Cross-Site Scripting

Exploit Title: D-LINK DKVM-IP8 XSS Vulnerability Date: 01-06-2010 Author: POPCORN Software Link: http://www.dlink.ru/ Version: 2282dlinkA4p820071213 Tested on: Windows Sp 2 Site : http://Hacking.ge Code : POST http://site.com80/auth.asp HTTP/1.0 Accept: / Content-Type:...

phpStat 1.5 - setup.php Authentication Bypass (Perl)

phpStat 1.5 - setup.php Authentication Bypass Perl !/usr/bin/perl T r a p - S e t U n d e r g r o u n d H a c k i n g T e a m EXPLOIT FOR - PHPStat Setup.PHP Authentication Bypass Vulnerability Exploit By : A l p h a P r o g r a m m e r Sirus-v E-Mail : [email protected] This Xpl Change...