nim-loader

nim-loader 通过拼凑资源来学习nim，创建一个实现常见EDR/AV规避技术的shellcode加载器，这是一个非常粗糙的进行中的冒险。 这很混乱，仅供研究目的！请不要指望它不经你自己的修改就能编译和运行。 使用说明 将 loader.nim 中的字节数组替换为你自己的 x64 shellcode 编译EXE并运行：nim c -d:danger -d:strip --opt:size "loader.nim" 可能要通过查看你使用的注入文件夹方法中的 .nim 文件来调整要注入到的进程... 已完成功能 从NTDLL动态解析的直接系统调用（感谢 @ShitSecure）...

go-shellcode

go-shellcode go-shellcode は、Windows 用 Shellcode ランナーと補助ユーティリティのリポジトリです。これらのアプリケーションは、さまざまな API 呼び出しやテクニックを使用して Shellcode をロードおよび実行します。 利用可能な Shellcode ランナーの一覧: CreateFiber CreateProcess CreateProcessWithPipe CreateRemoteThread CreateRemoteThreadNative CreateThread CreateThreadNative EarlyBird...

ncloader

Ncloader シンプルなDLLインジェクションユーティリティ 現在の設計では、よく知られたDLLインジェクション手法を実装しています: VirtualAllocEx リモートプロセス内の文字列用メモリを確保 WriteProcessMemory リモートに確保したメモリへ "path/to/dll/file" を書き込む CreateRemoteThread LoadLibraryA/W の開始アドレスと "path/to/dll/file" のアドレスをパラメータとして実行 特徴...

EUVD-2006-3781

Malware in sbrugna...

Jektor - A Windows User-Mode Shellcode Execution Tool That Demonstrates Various Techniques That Malware Uses

This utility focuses on shellcode injection techniques to demonstrate methods that malware may use to execute shellcode on a victim system Dynamically resolves API functions to evade IAT inclusion Includes usage of undocumented NT Windows API functions Supports local shellcode execution via...

FalconEye - Real-time detection software for Windows process injections

FalconEye is a windows endpoint detection software for real-time process injections. It is a kernel-mode driver that aims to catch process injections as they are happening real-time. Since FalconEye runs in kernel mode, it provides a stronger and reliable defense against process injection...

Staying Hidden on the Endpoint: Evading Detection with Shellcode

True red team assessments require a secondary objective of avoiding detection. Part of the glory of a successful red team assessment is not getting detected by anything or anyone on the system. As modern Endpoint Detection and Response EDR products have matured over the years, the red teams must...

Windows x64 - CreateRemoteThread() DLL Injection Shellcode (584 bytes)

Windows x64 - CreateRemoteThread DLL Injection Shellcode 584 bytes. Shellcode exploit for Winx86-64 platform / Title: Windows x64 dll injection shellcode using CreateRemoteThread Size: 584 bytes Date: 16-01-2017 Author: Roziul Hasan Khan Shifat Tested On : Windows 7 x64 / //Note : i wrtie it for...

Microsoft Windows 2000/2003/XP CreateRemoteThread Local Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/15671/info Microsoft Windows is prone to a local denial of service vulnerability. This issue can allow an attacker to trigger a system wide denial of service condition or terminate arbitrary processes. Reports indicate th...

Remote DLL - Simple & Free Tool to Inject or Remove DLL from Remote Process

RemoteDLL is the simple tool to Inject DLL or Remove DLL from Remote Process. It is based on popular Dll Injection technique. It supports following DLL Injection methods CreateRemoteThread NtCreateThread Good for DLL Injection across sessions on Vista/Windows 7 QueueUseAPC Delayed Injection...

Microsoft Windows NT200020032008XPVista7 - KiTrap0D User Mode to Ring Escalation (MS10-015)

Microsoft Windows NT200020032008XPVista7 - KiTrap0D User Mode to Ring Escalation MS10-015 Exploit-DB Mirror: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/11199.zip KiTrap0D.zip E-DB Note: Make sure to run "vdmallowed.exe" pre-compiled inside the subfolder...

Published some of Ring3 at the end of the process of skill-vulnerability warning-the black bar safety net

In response to the XHR call, in 2 0 0 8 年 5 月 5, re-finishing, and some new skills. 2 0 0 8 years 7 months 1 3 to increase a skill. All of OpenProcess/ZwOpenProcess/OpenThread/ZwOpenThread can replace the ZwQuerySystemInformation-ZwOpenProcess-ZwDuplicateObject it. Specific is why your own...

CVE-2006-3787

kpf4ss.exe in Sunbelt Kerio Personal Firewall 4.3.x before 4.3.268 does not properly hook the CreateRemoteThread API function, which allows local users to cause a denial of service crash and bypass protection mechanisms by calling CreateRemoteThread...

CVE-2006-3787: Undefined Security Weakness

kpf4ss.exe in Sunbelt Kerio Personal Firewall 4.3.x before 4.3.268 does not properly hook the CreateRemoteThread API function, which allows local users to cause a denial of service crash and bypass protection mechanisms by calling CreateRemoteThread...

Sunbelt Kerio Personal Firewall 4.3.426 - CreateRemoteThread Denial of Service

Sunbelt Kerio Personal Firewall 4.3.426 - CreateRemoteThread Denial of Service source: https://www.securityfocus.com/bid/18996/info Sunbelt Kerio Personal Firewall is prone to a denial-of-service vulnerability. This issue can occur when a program calls the 'CreateRemoteThread' Windows API call...

Sunbelt Kerio Personal Firewall 4.3.426 - CreateRemoteThread Denial of Service

source: https://www.securityfocus.com/bid/18996/info Sunbelt Kerio Personal Firewall is prone to a denial-of-service vulnerability. This issue can occur when a program calls the 'CreateRemoteThread' Windows API call. Exploitation of this vulnerability could cause the firewall application to crash...

CVE-2005-3981

Microsoft Windows XP, 2000, and 2003 are affected by a local-privilege issue where a user can kill a writable process by calling CreateRemoteThread on a process opened via OpenProcess, using certain arguments and potentially an invalid start routine address. The underlying cause involves manipula...

CVE-2005-3981: Undefined Security Weakness

NOTE: this issue has been disputed by third parties. Microsoft Windows XP, 2000, and 2003 allows local users to kill a writable process by using the CreateRemoteThread function with certain arguments on a process that has been opened using the OpenProcess function, possibly involving an invalid...

PT-2005-4719 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the patchday that contains the fix for this issue Description: This issue allows local users to kill a writable process by using the CreateRemoteThread function with certain arguments on a process that has...

winCreateExp.txt

Microsoft Windows CreateRemoteThread Exploit name : nima Salehi email : [email protected] web site : www.Ashiyane.com www.Ashiyane.net Copyright c 2002-2005 Ashiyane Digital Securty Team --------------------------------------------------------------------- Systems Affected: - Windows XP all SP -...