vba2clr

TLDR: Ich experimentiere gerade mit verschiedenen Möglichkeiten, CLR-Assemblies .NET in VBA lokal und remote zu laden, indem ich AppDomain.ExecuteAssembly oder eine andere praktische Methode verwende, nachdem ich von VBA aus AccessVBOM umgangen habe der programmatische Zugriff auf das...

ExecuteAssembly

Beschreibung: ExecuteAssembly ist eine Alternative zu CS execute-assembly, entwickelt in C/C++, und kann verwendet werden, um .NET-Assemblies zu laden/injizieren, indem es die geladenen CLR-Module/AppDomainManager des Host-Prozesses spawnto wiederverwendet, die PE-DOS-Header von...

DNCI

DNCI - Iniettore di Codice .Net DNCI consente l'iniezione di codice .Net .exe o .dll in remoto in processi non gestiti in Windows. 1. Struttura del Progetto Il progetto è strutturato in: DNCI.Injector.Library - Libreria di iniezione. Contiene tutti i componenti e la logica di iniezione;...

VMUnprotect.Dumper

VMUnprotect.Dumper VMUnprotect.Dumper é um projeto dedicado a caçar assemblies VMProtect adulterados. Ele utiliza AsmResolver para descompactar dinamicamente assemblies protegidos por VMP. Funciona no VMProtect 3.7.0 mais recente e algumas versões anteriores. Antes do uso do VMUnprotect.Dumper Ap...

reconerator

Panoramica Questo è un assembly .NET personalizzato che esegue una serie di attività di situational awareness. Sono disponibili diversi gruppi di funzionalità: BASIC - Ottiene informazioni dal disco e dal registro. LDAP - Consente di effettuare query LDAP AD personalizzate. RESOLVEHOST - Esegue...

LACheck

LACheck Enumerazione dei privilegi amministrativi locali con assembly .NET C multithread Argomenti root@kitploit: ./LACheck.exe help | | /\ / | | | | | | / \ | | | | | | | | / /\ \ | | | ' \ / / | |/ / | | / \ | || | | | / | |// \ || |||||\ Usage: LACheck.exe smb rpc...

inject-assembly

inject-assembly - Eseguire .NET in un Processo Esistente Questo strumento è un'alternativa alla tradizionale esecuzione fork and run per Cobalt Strike. Il loader può essere iniettato in qualsiasi processo, incluso il Beacon corrente. Gli assembly a lunga esecuzione continueranno a funzionare e...

Invoke-noPac

Invoke-noPac L'assembly .Net est basé sur mon fork https://github.com/ricardojba/noPac qui comporte quelques modifications de code pour améliorer l'original. Chargeur d'assembly .Net de style PowerSharpPack pour le scanner et l'exploit CVE-2021-42287 - CVE-2021-42278 noPac. Utilisation :...

link

link link is a command and control framework written in rust. Currently in beta. Table of Contents Introduction Features Feedback Build Process Acknowledgments Introduction...

InlineExecute-Assembly

InlineExecute-Assembly InlineExecute-Assembly é uma prova de conceito de Beacon Object File BOF que permite que profissionais de segurança realizem execução de assemblies .NET in-process como alternativa ao módulo tradicional fork and run execute-assembly do Cobalt Strike. O InlineExecute-Assembl...

reconerator

Overview This is a custom .NET assembly which will perform a number of situational awareness activities. There are a number of current featuresets: BASIC - Obtains information from the disk and registry. LDAP - Allows customised AD LDAP queries to be made. RESOLVEHOST - Performs DNS lookup querie...

dllspy

DllSpy Analizza gli assembly .NET compilati per scoprire superfici di input endpoint HTTP, hub SignalR, servizi WCF, servizi gRPC, pagine Razor, componenti Blazor, Funzioni di Azure, endpoint OData, verificare la configurazione dell'autorizzazione e segnalare problemi di sicurezza — il tutto senz...

aether

Aether Version: 0.9 stabile Version Aether ist ein Windows-Tool für Memory-Forensik und Threat Hunting, das den Live-Prozessspeicher nach schädlichen Mustern durchsucht, Injektionstechniken, Implantat-Signaturen und reflektiv geladene .NET-Assemblys erkennt. Es arbeitet mit einem mehrschichtigen...

EUVD-2016-6200

Malware in sbrugna...

Aladdin - Payload Generation Technique That Allows The Deseriallization Of A .NET Payload And Execution In Memory

Aladdin is a payload generation technique based on the work of James Forshaw @tiraniddo that allows the deseriallization of a .NET payload and execution in memory. The original vector was documented on https://www.tiraniddo.dev/2017/07/dg-on-windows-10-s-executing-arbitrary.html. By spawning the...

InlineExecute-Assembly - A PoC Beacon Object File (BOF) That Allows Security Professionals To Perform In Process .NET Assembly Execution

InlineExecute-Assembly is a proof of concept Beacon Object File BOF that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module. InlineExecute-Assembly will execute any assembly with the entr...

Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization Exploit

This Metasploit module exploits the .NET deserialization vulnerability within the RadAsyncUpload RAU component of Telerik UI ASP.NET AJAX that is identified as CVE-2019-18935. In order to do so the module must upload a mixed mode .NET assembly DLL which is then loaded through the deserialization...

WebSocket C2 Communication Channel: WSC2

WSC2 is a PoC of using the WebSockets and a browser process to serve as a C2 communication channel between an agent, running on the target system, and a controller acting as the actuel C2 server. WSC2 is composed of: a controller, written in Python, which acts as the C2 server an agent running on...

VirtualBox 5.0.32 r112930 x64 - Windows Process COM Injection Privilege Escalation Exploit

Exploit for windows platform in category local exploits Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1103 VirtualBox: Windows Process COM Injection EoP Platform: VirtualBox v5.0.32 r112930 x64 Tested on Windows 10 Class: Elevation of Privilege Summary: The process hardening...

CVE-2016-5249

Lenovo Solution Center LSC before 3.3.003 allows local users to execute arbitrary code with LocalSystem privileges via vectors involving the LSC.Services.SystemService StartProxy command with a named pipe created in advance and crafted .NET assembly...