BOF_ExecuteAssembly

BOF Execute-Assembly Beacon Object File для Cobalt Strike, выполняющий .NET сборки в beacon с техниками обхода. Обзор Основная архитектура root@kitploit: ┌──────────────────────────────────────────────────────────────────────────────┐ │ Beacon Cobalt Strike │ │ родительский процесс │...

Get-PDInvokeImports

Get-PDInvokeImports Описание: Get-PDInvokeImports — это инструмент модуль PowerShell, способный выполнять автоматическое обнаружение использования P/Invoke, Dynamic P/Invoke и D/Invoke в сборке. Показывает все места, откуда они вызываются, и экспортирует все в DnSpyBookmarks.xml. Этот PS-модуль...

donut

Текущая версия: v1.1 Содержание 1. Введение 2. Как это работает 3. Сборка 4. Использование 5. Подпроекты 6. Разработка с Donut 7. Вопросы и обсуждения 8. Отказ от ответственности 1. Введение Donut — это позиционно-независимый код, который позволяет выполнять в памяти VBScript, JScript, EXE, DLL и...

route-sixty-sink

✏️ 기여자 Dillon Franke @dillonfranke Michael Maturi @a-marionette 📝 블로그 https://www.mandiant.com/resources/route-sixty-sink-launch ⚓ Route Sixty-Sink Route Sixty-Sink 는 방어자와 보안 연구자가 자동화된 소스-싱크 분석source-to-sink analysis을 사용하여 모든 .NET 어셈블리에서 취약점을 신속하게 식별할 수 있게 해주는 오픈 소스 도구입니다. 애플리케이션 바이너리 또는 소스 코드 내의...

inject-assembly

inject-assembly - Execute .NET in an Existing Process This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon,...

CustomLoadImage

CustomLoadImage CustomLoadImage は、.NETアセンブリのステルス的なリフレクティブロードを可能にします。 これは、AssemblyNative::LoadFromBuffer を直接呼び出すことで行われ、RuntimeAssembly.nLoadImage に仕掛けられたフックが実行されないことを保証します。 このプロジェクトが役に立った場合は、スターをよろしくお願いします。...

ModernLoader delivers multiple stealers, cryptominers and RATs

By Vanja Svajcer Cisco Talos recently observed three separate, but related, campaigns between March and June 2022 delivering a variety of threats, including the ModernLoader bot, RedLine information-stealer and cryptocurrency-mining malware to victims. The actors use PowerShell, .NET assemblies,...

ExecuteAssembly - Load/Inject .NET Assemblies

ExecuteAssembly is an alternative of CS execute-assembly, built with C/C++ and it can be used to Load/Inject .NET assemblies by; reusing the host spawnto process loaded CLR Modules/AppDomainManager, Stomping Loader/.NET assembly PE DOS headers, Unlinking .NET related modules, bypassing ETW+AMSI,...

Donut - Generates X86, X64, Or AMD64+x86 Position-Independent Shellcode That Loads .NET Assemblies, PE Files, And Other Windows Payloads From Memory

Donut generates x86 or x64 shellcode from VBScript, JScript, EXE, DLL including .NET Assemblies files. This shellcode can be injected into an arbitrary Windows processes for in-memory execution. Given a supported file type, parameters and an entry point where applicable such as Program.Main, it...

RemoteRecon - Remote Recon And Collection

RemoteRecon provides the ability to execute post-exploitation capabilities against a remote host, without having to expose your complete toolkit/agent. Often times as operator's we need to compromise a host, just so we can keylog or screenshot or some other miniscule task against a person/host of...

Bring Your Own Land (BYOL) – A Novel Red Teaming Technique

Introduction One of most significant recent developments in sophisticated offensive operations is the use of “Living off the Land” LotL techniques by attackers. These techniques leverage legitimate tools present on the system, such as the PowerShell scripting language, in order to execute attacks...