DLLirant

DLLirant DLLirant é uma ferramenta para automatizar as pesquisas de DLL Hijacking e DLL Proxying em um binário especificado. Saída final do PoC quando um DLL Hijacking é encontrado: Demonstração ao vivo antiga semelhante à nova versão Como instalar Instale o LLVM para Windows x64...

TeamsImplant

TeamsImplant Dieses Projekt ist ein heimliches Teams-Implant, das die von Teams verwendete urlmon.dll proxyt. Kompilieren Sie dieses Ding und legen Sie es als urlmon.dll im Teams-Verzeichnis ab, und Sie haben eine persistente Hintertür, sobald Teams von einem Benutzer oder beim Start ausgeführt...

CVE-2024-22774

Panoramic Dental Imaging Software 9.1.2.7600. Escalation dei privilegi tramite hijack di DLL fantasma CVE-2024-22774 Indice Indice Introduzione Versione finale del software Ricerca di DLL hijackabili Preparazione dell'attacco Exploit Persistenza dopo l'installazione del sistema operativo...

ExportDumper

ExportDumper أداة صغيرة صنعتها لتفريغ جدول التصدير export table لملفات PE. كانت حالة الاستخدام الأساسية مخصصة للاستخدام ضمن DLL proxying. الاستخدام root@kitploit: .\ExportDump dllpath مثال: root@kitploit: .\ExportDump C:\Windows\System32\version.dll Dumping all 17 exported functions from...

How ToddyCat tried to hide behind AV software

To hide their activity in infected systems, APT groups resort to various techniques to bypass defenses. Most of these techniques are well known and detectable by both EPP solutions and EDR threat-monitoring and response tools. For example, to hide their activity in Windows systems, cybercriminals...

ThievingFox - Remotely Retrieving Credentials From Password Managers And Windows Utilities

ThievingFox is a collection of post-exploitation tools to gather credentials from various password managers and windows utilities. Each module leverages a specific method of injecting into the target process, and then hooks internals functions to gather crendentials. The accompanying blog post ca...