692 matches found
memhunter
Memhunter Automated hunting of memory resident malware at scale This project is WORK IN PROGRESS. Expect feature changes and binary releases on the upcoming weeks. Overview Memhunter is an endpoint sensor tool that is specialized in detecing resident malware, improving the threat hunter analysis...
Cooolis-ms
Cooolis-ms Wiki Documentation Cooolis-ms is a code execution tool that includes a Metasploit Payload Loader, Cobalt Strike External C2 Loader, and Reflective DLL injection. It is designed to evade static detection of code we intend to execute that contains known signatures, helping red team...
dll-injector
About As the name suggests, the application primarily performs injecting a DLL into any process running on Windows. With the power of this, it is able to perform several operations on a process such as loading a DLL, unloading a DLL, and hooking primary WinAPI functions e.g., CreateFileW, ReadFil...
Evasor
Overview The Evasor is an automated security assessment tool which locates existing executables on the Windows operating system that can be used to bypass any Application Control rules. It is very easy to use, quick, saves time and fully automated which generates for you a report including...
DuplexSpyCS
DuplexSpy DuplexSpyCS CS stands for CSharp is a open source RAT base on C/S Continuously update: Branch-Version2.1.0 Documents The online documents are here: DuplexSpy Fileless Execution DLL and shellcode injector and loader Remote Plugin Proxy Introduction DuplexSpy is a open-source Windows RAT...
MappedImagesDetector
MappedImagesDetector Native Windows memory scanner for detecting malicious DLL injections and in-memory malware MappedImagesDetector is a low-level C++20 Windows tool designed to detect malicious DLL injection techniques used by modern malware, including manual-mapped DLLs, erased PE headers, and...
EvtMute
EvtMute This is a tool that allows you to offensively use YARA to apply a filter to the events being reported by windows event logging. Usage Grap the latest verison from here. EvtMuteHook.dll contains the core functionality, once it is injected it will apply a temporary filter which will allow a...
PuttyRider
PuttyRider Hijack Putty sessions in order to sniff conversation and inject Linux commands. Download PuttyRider-bin.zip Documentation Defcamp 2014 presentation - pdf Defcamp 2014 presentation - video Examples List existing Putty processes and their status injected / not injected PuttyRider.exe -l...
TotalRecall
TotalRecall Reloaded Breaking Windows Recall. Again. image When Microsoft redesigned Recall with VBS enclaves, AES-256-GCM encryption, Windows Hello authentication, and a Protected Process Light host, the message was clear: the data is locked in a vault. The vault is solid. The delivery truck is...
hollows_hunter
hollowshunter Hollows Hunter is a command-line application based on PE-sieve passive memory scanner. Recognizes and dumps a variety of potentially malicious implants replaced/implanted PEs, shellcodes, hooks, in-memory patches. While in case of PE-sieve you can select the process only by its PID,...
Nidhogg
Nidhogg Nidhogg is a multi-functional rootkit to showcase the variety of operations that can be done from kernel space. The goal of Nidhogg is to provide an all-in-one and easy-to-use rootkit with multiple helpful functionalities for operations. Besides that, it can also easily be integrated with...
BoomER
BoomER BoomER is an open source framework, developed in Python. The tool is focused on post-exploitation, with a main objective, the detection and exploitation of local vulnerabilities, as well as the collection of information from a system, such as the installed applications they have. The...
sRDI
sRDI - Shellcode Reflective DLL Injection sRDI allows for the conversion of DLL files to position independent shellcode. It attempts to be a fully functional PE loader supporting proper section permissions, TLS callbacks, and sanity checks. It can be thought of as a shellcode PE loader strapped t...
CobaltStrikeScan
CobaltStrikeScan Scan files or process memory for Cobalt Strike beacons and parse their configuration. CobaltStrikeScan scans Windows process memory for evidence of DLL injection classic or reflective injection and/or performs a YARA scan on the target process' memory for Cobalt Strike v3 and v4...
InjectProc
InjectProc Process injection is a very popular method to hide malicious behavior of code and are heavily used by malware authors. There are several techniques, which are commonly used: DLL injection, process replacement a.k.a process hollowing, hook injection and APC injection. Most of them use...
staged-DLL-Injection-SMB-
staged-DLL-Injection Staged DLL injection proof-of-concept built in C using Win32 APIs — developed in an isolated lab environment for red team certification study CRTO. ⚠️ Disclaimer: This project was developed strictly in an isolated lab environment for educational purposes as part of offensive...
Prineo_RE
About PriPara internal name Prineo is an arcade rythm game developed by SynSophia. Goal The goal of this project was to reverse the model format of the arcade series in order to port exclusive characters to the newer version of the game on Nintendo Switch. Screenshots Some interesting screenshots...
zirconium
zirconium DLL-injectable game cheat for Call of Duty: Black Ops 2 Zombies with the Plutonium mod. Downloads are in the Releases page Disclaimer: This project exists because I grew up on BO2, and it also happened to be a good target for reversing. It's a 14 year old AAA game thats practically dead...
RemoteDLLInjector
Introduction This is a tools which can be used to dll injection： From the moment that RemoteDLLInjector executes will provide the full steps that performs in order to achieve DLL injection. If the DLL is successfully injected it will return back a meterpreter session with the privileges of the...