frostbyte

FrostByte 前言： 过去几天我一直在尝试 AppDomain 管理器注入 技术，在之前的红队演练中，它针对某些 EDR 取得了不错的成功。虽然这对于初始访问向量来说非常不错，但我想发布一个 POC，帮助你将 shellcode 隐藏在其他地方。不再需要嵌入 shellcode 的 DLL 文件！ 问题！ 虽然这是一项独立使用时非常出色的技术，但当与诸如通过 ISO/ZIP/VHD/VHDX 文件发送 C ClickOnce 之类的投递技术结合时，真正的问题是：有十分之一的概率，用于 appdomain 的 DLL 会被 AV/EDR 的 AI/ML 启发式检测到。这是因为在初始化...

frostbyte

FrostByte Progolue: In the past few days I've been experimenting with the AppDomain manager injection technique had a decent success with it in my previous Red Team engagements against certain EDRs. Although, this is really good for initial access vector, I wanted to release a POC which will help...

inject-assembly

inject-assembly - Execute .NET in an Existing Process This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon,...

clrinject

clrinject 将C EXE或DLL程序集注入到另一个进程的任何CLR运行时和AppDomain中。注入的程序集随后可以访问被注入进程类的静态实例，从而影响其内部状态。 使用方法 clrinject-cli.exe -p -a 打开ID为 或名称为 的进程，注入 EXE并执行Main方法。 附加选项 -e 枚举所有已加载的CLR运行时和已创建的AppDomain。 -d 只注入到第个AppDomain。如果未指定数字或指定为0，程序集将注入到每个AppDomain。 -i . 从命名空间创建类的实例。 示例 使用示例 clrinject-cli.exe -p victim.exe -...

APT41-Linked Silver Dragon Targets Governments Using Cobalt Strike and Google Drive C2

Cybersecurity researchers have disclosed details of an advanced persistent threat APT group dubbed Silver Dragon that has been linked to cyber attacks targeting entities in Europe and Southeast Asia since at least mid-2024. "Silver Dragon gains its initial access by exploiting public-facing...

Exploit for Incorrect Comparison in Dynamic-Linq Linq

Dynamic Linq injection to RCE - CVE-2023-32571 About Dynami...

Donut - Generates X86, X64, Or AMD64+x86 Position-Independent Shellcode That Loads .NET Assemblies, PE Files, And Other Windows Payloads From Memory

Donut generates x86 or x64 shellcode from VBScript, JScript, EXE, DLL including .NET Assemblies files. This shellcode can be injected into an arbitrary Windows processes for in-memory execution. Given a supported file type, parameters and an entry point where applicable such as Program.Main, it...