inject-assembly

inject-assembly - किसी मौजूदा प्रक्रिया में .NET निष्पादित करें यह टूल Cobalt Strike के लिए पारंपरिक fork and run निष्पादन का एक विकल्प है। लोडर को किसी भी प्रक्रिया में इंजेक्ट किया जा सकता है, जिसमें वर्तमान Beacon भी शामिल है। लंबे समय तक चलने वाली असेंबली चलती रहेंगी और Beacon को आउटपुट वापस...

LACheck

LACheck Enumerazione dei privilegi amministrativi locali con assembly .NET C multithread Argomenti root@kitploit: ./LACheck.exe help | | /\ / | | | | | | / \ | | | | | | | | / /\ \ | | | ' \ / / | |/ / | | / \ | || | | | / | |// \ || |||||\ Usage: LACheck.exe smb rpc...

ExecuteAssembly

Descrizione: ExecuteAssembly è un'alternativa a CS execute-assembly, costruito in C/C++ e può essere utilizzato per caricare/iniettare assembly .NET tramite; riutilizzo dei moduli CLR/AppDomainManager caricati dal processo host spawnto, stomping dei loader/assembly .NET degli header PE DOS,...

DNCI

DNCI - Iniettore di Codice .Net DNCI consente l'iniezione di codice .Net .exe o .dll in remoto in processi non gestiti in Windows. 1. Struttura del Progetto Il progetto è strutturato in: DNCI.Injector.Library - Libreria di iniezione. Contiene tutti i componenti e la logica di iniezione;...

InlineExecute-Assembly

InlineExecute-Assembly InlineExecute-Assembly è un Beacon Object File BOF proof-of-concept che consente ai professionisti della sicurezza di eseguire assembly .NET in-process, in alternativa al tradizionale modulo execute-assembly di Cobalt Strike basato su fork-and-run. InlineExecute-Assembly...

vba2clr

TLDR: Solo sperimentando diversi modi per caricare assembly CLR .NET in VBA localmente e remotamente usando AppDomain.ExecuteAssembly o qualsiasi altro metodo utile dopo aver aggirato AccessVBOM l'accesso programmatico al progetto Visual Basic non è attendibile da VBA. vba2clr..vba: Imposta la...

reconerator

Panoramica Questo è un assembly .NET personalizzato che esegue una serie di attività di situational awareness. Sono disponibili diversi gruppi di funzionalità: BASIC - Ottiene informazioni dal disco e dal registro. LDAP - Consente di effettuare query LDAP AD personalizzate. RESOLVEHOST - Esegue...

reconerator

Overview This is a custom .NET assembly which will perform a number of situational awareness activities. There are a number of current featuresets: BASIC - Obtains information from the disk and registry. LDAP - Allows customised AD LDAP queries to be made. RESOLVEHOST - Performs DNS lookup querie...

Invoke-noPac

Invoke-noPac Die .Net-Assembly basiert auf meinem Fork https://github.com/ricardojba/noPac, der einige Code-Änderungen enthält, um das Original zu verbessern. PowerSharpPack style .Net Assembly loader für den CVE-2021-42287 - CVE-2021-42278 Scanner & Exploit noPac. Verwendung: root@kitploit:...

dllspy

DllSpy Analyse les assemblys .NET compilés pour découvrir les surfaces d'entrée points de terminaison HTTP, hubs SignalR, services WCF, services gRPC, pages Razor, composants Blazor, fonctions Azure, points de terminaison OData, vérifier la configuration d'autorisation et signaler des problèmes d...

VMUnprotect.Dumper

VMUnprotect.Dumper VMUnprotect.Dumper è un progetto che si occupa di scovare assembly VMProtect manomessi. Utilizza AsmResolver per decomprimere dinamicamente assembly protetti da VMP. Funziona su VMProtect 3.7.0 ultima versione e alcune versioni precedenti. Prima dell'uso di VMUnprotect.Dumper...

link

link link is a command and control framework written in rust. Currently in beta. Table of Contents Introduction Features Feedback Build Process Acknowledgments Introduction...

aether

Aether versione : 0.9 versione stabile Aether è uno strumento di memory forensics e threat hunting per Windows che scansiona la memoria dei processi in esecuzione alla ricerca di pattern dannosi, rileva tecniche di injection, firme di implant e assembly .NET caricati in modo riflesso. Funziona co...

EUVD-2016-6200

Malware in sbrugna...

Aladdin - Payload Generation Technique That Allows The Deseriallization Of A .NET Payload And Execution In Memory

Aladdin is a payload generation technique based on the work of James Forshaw @tiraniddo that allows the deseriallization of a .NET payload and execution in memory. The original vector was documented on https://www.tiraniddo.dev/2017/07/dg-on-windows-10-s-executing-arbitrary.html. By spawning the...

InlineExecute-Assembly - A PoC Beacon Object File (BOF) That Allows Security Professionals To Perform In Process .NET Assembly Execution

InlineExecute-Assembly is a proof of concept Beacon Object File BOF that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module. InlineExecute-Assembly will execute any assembly with the entr...

Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization Exploit

This Metasploit module exploits the .NET deserialization vulnerability within the RadAsyncUpload RAU component of Telerik UI ASP.NET AJAX that is identified as CVE-2019-18935. In order to do so the module must upload a mixed mode .NET assembly DLL which is then loaded through the deserialization...

WebSocket C2 Communication Channel: WSC2

WSC2 is a PoC of using the WebSockets and a browser process to serve as a C2 communication channel between an agent, running on the target system, and a controller acting as the actuel C2 server. WSC2 is composed of: a controller, written in Python, which acts as the C2 server an agent running on...

VirtualBox 5.0.32 r112930 x64 - Windows Process COM Injection Privilege Escalation Exploit

Exploit for windows platform in category local exploits Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1103 VirtualBox: Windows Process COM Injection EoP Platform: VirtualBox v5.0.32 r112930 x64 Tested on Windows 10 Class: Elevation of Privilege Summary: The process hardening...

CVE-2016-5249

Lenovo Solution Center LSC before 3.3.003 allows local users to execute arbitrary code with LocalSystem privileges via vectors involving the LSC.Services.SystemService StartProxy command with a named pipe created in advance and crafted .NET assembly...