staged-DLL-Injection-SMB-

staged-DLL-Injection Staged DLL injection proof-of-concept built in C using Win32 APIs — developed in an isolated lab environment for red team certification study CRTO. ⚠️ Disclaimer: This project was developed strictly in an isolated lab environment for educational purposes as part of offensive...

Evasor

Overview The Evasor is an automated security assessment tool which locates existing executables on the Windows operating system that can be used to bypass any Application Control rules. It is very easy to use, quick, saves time and fully automated which generates for you a report including...

Cooolis-ms

Cooolis-ms Wiki Documentation Cooolis-ms is a code execution tool that includes a Metasploit Payload Loader, Cobalt Strike External C2 Loader, and Reflective DLL injection. It is designed to evade static detection of code we intend to execute that contains known signatures, helping red team...

TotalRecall

TotalRecall Reloaded Breaking Windows Recall. Again. image When Microsoft redesigned Recall with VBS enclaves, AES-256-GCM encryption, Windows Hello authentication, and a Protected Process Light host, the message was clear: the data is locked in a vault. The vault is solid. The delivery truck is...

VMInjector

V M I n j e c t o r c 2012 by Marco Batista Licensed under GPLv3 see LICENSE file Overview: VMInjector is a tool designed to bypass OS login authentication screens of major operating systems running on VMware Workstation/Player, by using direct memory manipulation. Description: VMInjector is a to...

EvtMute

EvtMute This is a tool that allows you to offensively use YARA to apply a filter to the events being reported by windows event logging. Usage Grap the latest verison from here. EvtMuteHook.dll contains the core functionality, once it is injected it will apply a temporary filter which will allow a...

DuplexSpyCS

DuplexSpy DuplexSpyCS CS stands for CSharp is a open source RAT base on C/S Continuously update: Branch-Version2.1.0 Documents The online documents are here: DuplexSpy Fileless Execution DLL and shellcode injector and loader Remote Plugin Proxy Introduction DuplexSpy is a open-source Windows RAT...

SpoolFool

SpoolFool Exploit for CVE-2022-21999 - Windows Print Spooler Elevation of Privilege Vulnerability LPE Details The provided exploit should work by default on all Windows desktop versions. Please see the blog post for full technical details here. Usage PS C:\SpoolFool .\SpoolFool.exe SpoolFool By...

PuttyRider

PuttyRider Hijack Putty sessions in order to sniff conversation and inject Linux commands. Download PuttyRider-bin.zip Documentation Defcamp 2014 presentation - pdf Defcamp 2014 presentation - video Examples List existing Putty processes and their status injected / not injected PuttyRider.exe -l...

hollows_hunter

hollowshunter Hollows Hunter is a command-line application based on PE-sieve passive memory scanner. Recognizes and dumps a variety of potentially malicious implants replaced/implanted PEs, shellcodes, hooks, in-memory patches. While in case of PE-sieve you can select the process only by its PID,...

CobaltStrikeScan

CobaltStrikeScan Scan files or process memory for Cobalt Strike beacons and parse their configuration. CobaltStrikeScan scans Windows process memory for evidence of DLL injection classic or reflective injection and/or performs a YARA scan on the target process' memory for Cobalt Strike v3 and v4...

Nidhogg

Nidhogg Nidhogg is a multi-functional rootkit to showcase the variety of operations that can be done from kernel space. The goal of Nidhogg is to provide an all-in-one and easy-to-use rootkit with multiple helpful functionalities for operations. Besides that, it can also easily be integrated with...

sRDI

sRDI - Shellcode Reflective DLL Injection sRDI allows for the conversion of DLL files to position independent shellcode. It attempts to be a fully functional PE loader supporting proper section permissions, TLS callbacks, and sanity checks. It can be thought of as a shellcode PE loader strapped t...

venom-rs

Shellcode Reflective DLL Injection sRDI in Rust Codename: Venom Shellcode reflective DLL injection sRDI is a process injection technique that allows us to convert a given DLL into a position-independent code which can then be injected using our favourite shellcode injection and execution techniqu...

EDR-Preloader

EDR-Preloader An EDR bypass that prevent EDRs from hooking or loading DLLs into our process by hijacking the AppVerifier layer For details, see: malwaretech.com/2024/02/bypassing-edrs-with-edr-preload.html...

PCShare

PCShare is a powerful remote control software that can monitor the target machine's screen, registry, file system, etc. 1. Software Usage Introduction: 2. Start PcShare.exe, which is the main program of the control end. This program will listen for connections from the controlled end on port 8080...

zirconium

zirconium DLL-injectable game cheat for Call of Duty: Black Ops 2 Zombies with the Plutonium mod. Downloads are in the Releases page Disclaimer: This project exists because I grew up on BO2, and it also happened to be a good target for reversing. It's a 14 year old AAA game thats practically dead...

memhunter

Memhunter Automated hunting of memory resident malware at scale This project is WORK IN PROGRESS. Expect feature changes and binary releases on the upcoming weeks. Overview Memhunter is an endpoint sensor tool that is specialized in detecing resident malware, improving the threat hunter analysis...

BoomER

BoomER BoomER is an open source framework, developed in Python. The tool is focused on post-exploitation, with a main objective, the detection and exploitation of local vulnerabilities, as well as the collection of information from a system, such as the installed applications they have. The...

InjectProc

InjectProc Process injection is a very popular method to hide malicious behavior of code and are heavily used by malware authors. There are several techniques, which are commonly used: DLL injection, process replacement a.k.a process hollowing, hook injection and APC injection. Most of them use...