CustomLoadImage

CustomLoadImage CustomLoadImage 允许以隐蔽的方式反射加载 .NET 程序集。 这是通过直接调用 AssemblyNative::LoadFromBuffer 实现的，确保放置在 RuntimeAssembly.nLoadImage 上的钩子不会被执行。 如果该项目对您有帮助，请点个星标...

BOF_ExecuteAssembly

BOF Execute-Assembly Beacon Object File para Cobalt Strike que ejecuta ensamblados .NET en beacon con técnicas de evasión. Resumen Arquitectura Principal ┌──────────────────────────────────────────────────────────────────────────────┐ │ Cobalt Strike Beacon │ │ Proceso Padre │...

inject-assembly

inject-assembly - Execute .NET in an Existing Process This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon,...

Get-PDInvokeImports

Get-PDInvokeImports 描述： Get-PDInvokeImports 是一个工具（PowerShell 模块），能够自动检测程序集中 P/Invoke、动态 P/Invoke 和 D/Invoke 的使用情况。它显示所有引用这些调用的位置，并将所有内容导出为 DnSpyBookmarks.xml。 该 PS 模块在逆向 .NET 程序集时非常有用，可快速揭示程序集中使用的非托管 API 函数调用。有时恶意软件程序集充满垃圾代码，其主要功能通过直接调用 WIN API 或 NTAPI 实现。 Get-PDInvokeImports 让您快速概览程序集中使用了哪些...

donut

当前版本：v1.1 目录 1. 简介 2. 工作原理 3. 构建 4. 用法 5. 子项目 6. 使用 Donut 进行开发 7. 问题和讨论 8. 免责声明 1. 简介 Donut 是一个位置无关代码，能够在内存中执行 VBScript、JScript、EXE、DLL 文件和 .NET 程序集。Donut 创建的模块可以从 HTTP 服务器分段加载，或直接嵌入到加载器本身中。该模块可选地使用 Chaskey 分组密码和 128 位随机生成的密钥进行加密。文件在内存中加载并执行后，原始引用会被擦除以阻止内存扫描器。生成器和加载器支持以下特性： 使用 aPLib 和...

route-sixty-sink

✏️ Colaboradores Dillon Franke @dillonfranke Michael Maturi @a-marionette 📝 Blog https://www.mandiant.com/resources/route-sixty-sink-launch ⚓ Route Sixty-Sink Route Sixty-Sink es una herramienta de código abierto que permite tanto a defensores como a investigadores de seguridad identificar...

de4dot

Descripción de4dot es un desofuscador y desempaquetador de .NET de código abierto GPLv3 escrito en C. Hará todo lo posible por restaurar un ensamblado empaquetado y ofuscado hasta dejarlo casi como el ensamblado original. La mayor parte de la ofuscación puede restaurarse por completo p. ej. el...

ModernLoader delivers multiple stealers, cryptominers and RATs

By Vanja Svajcer Cisco Talos recently observed three separate, but related, campaigns between March and June 2022 delivering a variety of threats, including the ModernLoader bot, RedLine information-stealer and cryptocurrency-mining malware to victims. The actors use PowerShell, .NET assemblies,...

ExecuteAssembly - Load/Inject .NET Assemblies

ExecuteAssembly is an alternative of CS execute-assembly, built with C/C++ and it can be used to Load/Inject .NET assemblies by; reusing the host spawnto process loaded CLR Modules/AppDomainManager, Stomping Loader/.NET assembly PE DOS headers, Unlinking .NET related modules, bypassing ETW+AMSI,...

Donut - Generates X86, X64, Or AMD64+x86 Position-Independent Shellcode That Loads .NET Assemblies, PE Files, And Other Windows Payloads From Memory

Donut generates x86 or x64 shellcode from VBScript, JScript, EXE, DLL including .NET Assemblies files. This shellcode can be injected into an arbitrary Windows processes for in-memory execution. Given a supported file type, parameters and an entry point where applicable such as Program.Main, it...

RemoteRecon - Remote Recon And Collection

RemoteRecon provides the ability to execute post-exploitation capabilities against a remote host, without having to expose your complete toolkit/agent. Often times as operator's we need to compromise a host, just so we can keylog or screenshot or some other miniscule task against a person/host of...

Bring Your Own Land (BYOL) – A Novel Red Teaming Technique

Introduction One of most significant recent developments in sophisticated offensive operations is the use of “Living off the Land” LotL techniques by attackers. These techniques leverage legitimate tools present on the system, such as the PowerShell scripting language, in order to execute attacks...