RDPCredentialStealer

RDPCredentialStealer RDPCredentialStealer est un implant qui vole les identifiants fournis par les utilisateurs dans RDP en utilisant le hooking d'API avec Detours en C++ Preuve de concept pour le vol d'identifiants Essayons ceci : Tout d'abord, je transfère la DLL du dépôt GitHub vers le chemin...

aDLL

aDLL - Aventure de la bibliothèque de liens dynamiques aDLL est un outil d'analyse binaire axé sur la découverte automatique de vulnérabilités de détournement de DLL. L'outil analyse l'image du binaire chargé en mémoire pour rechercher les DLL chargées au moment du chargement et utilise la...

NoArgs

NoArgs : Manipulation et Dissimulation des Arguments de Processus Twitter : @AzizWho Avertissement : Usage Éducatif Uniquement Cet outil est destiné exclusivement à des fins éducatives. Je ne suis pas responsable de toute utilisation abusive et tous les utilisateurs doivent respecter les lois en...

Detours

Microsoft Research Detours Package Detours는 Windows에서 API 호출을 모니터링하고 계측하기 위한 소프트웨어 패키지입니다. Detours는 많은 ISV독립 소프트웨어 공급업체와 Microsoft의 제품 팀에서도 사용되어 왔습니다. Detours는 이제 표준 오픈 소스 라이선스MIT로 제공됩니다. 이로써 Detours를 사용하는 프로그래머의 라이선스 절차가 간소화되고 커뮤니티가 오픈 소스 도구와 프로세스를 사용하여 Detours를 지원할 수 있게 됩니다. Detours는 Windows NT...

NoArgs - Tool Designed To Dynamically Spoof And Conceal Process Arguments While Staying Undetected

NoArgs is a tool designed to dynamically spoof and conceal process arguments while staying undetected. It achieves this by hooking into Windows APIs to dynamically manipulate the Windows internals on the go. This allows NoArgs to alter process arguments discreetly. Default Cmd: Windows Event Logs...

DLLHSC - DLL Hijack SCanner A Tool To Assist With The Discovery Of Suitable Candidates For DLL Hijacking

DLL Hijack SCanner - A tool to generate leads and automate the discovery of candidates for DLL Search Order Hijacking Contents of this repository This repository hosts the Visual Studio project file for the tool DLLHSC, the project file for the API hooking functionality detour, the project file f...

Remote Symbol Resolution

Introduction The following blog discusses a couple of common techniques that malware uses to obscure its access to the Windows API. In both forms examined, analysts must calculate the API start address and resolve the symbol from the runtime process in order to determine functionality. After...

Remote Symbol Resolution

Introduction The following blog discusses a couple of common techniques that malware uses to obscure its access to the Windows API. In both forms examined, analysts must calculate the API start address and resolve the symbol from the runtime process in order to determine functionality. After...

Microsoft Fixes 47 Vulnerabilities with September Patch Tuesday

Microsoft patched 47 vulnerabilities as part of 14 security bulletins, seven critical, with its monthly Patch Tuesday updates today. The company is warning users that if left unpatched, 10 of the issues can lead to remote execution. The updates resolve issues in Microsoft Windows, Office, Office...

Detours to modify the paragraph properties of vulnerability-vulnerability warning-the black bar safety net

Detours to modify the paragraph properties of the vulnerability Affected Software and systems Detours3. 0 and previous versions Description This issue will be its positioning as a vulnerability may be less suitable, the more likely that Detours a BUG, but because the defect will cause the exploit...

Detours information leak vulnerability-vulnerability warning-the black bar safety net

Detours information leak vulnerability Affected Software and systems Detours3. 0 and previous versions Description With the vulnerability related to the earliest description found in tk, the leader found the“Microsoft EMET destruction of the system The ASLR security mechanism of Vulnerability”in...

Quake 3 Engine Client - CG_ServerCommand() Remote Overflow

Quake 3 Engine Client - CGServerCommand Remote Overflow / Quake 3 Engine Client CGServerCommand Remote Stack Overflow Exploit Win32 Written by RunningBon E-Mail: [email protected] IRC: irc.rizon.net kik This is a DLL, which gets injected into the server exe. You will need Microsoft Detours...

Quake 3 Engine Client (Windows x86) - CS_ITEms Remote Overflow

/ Quake 3 Engine Client CSITEMS Remote Stack Overflow Exploit Win32 Written by RunningBon E-Mail: [email protected] IRC: irc.rizon.net kik This is a DLL, which gets injected into the server exe. You will need Microsoft Detours library to compile this exploit...

Quake 3 Engine Client CG_ServerCommand() Remote Overflow Exploit

Exploit for unknown platform in category dos / poc ================================================================ Quake 3 Engine Client CGServerCommand Remote Overflow Exploit ================================================================ / Quake 3 Engine Client CGServerCommand Remote Stack...

Quake 3 Engine Client CS_ITEMS Remote Overflow Exploit (Win32)

Exploit for unknown platform in category dos / poc ============================================================== Quake 3 Engine Client CSITEMS Remote Overflow Exploit Win32 ============================================================== / Quake 3 Engine Client CSITEMS Remote Stack Overflow Exploi...

Quake 3 Engine Client - 'CG_ServerCommand()' Remote Overflow

/ Quake 3 Engine Client CGServerCommand Remote Stack Overflow Exploit Win32 Written by RunningBon E-Mail: [email protected] IRC: irc.rizon.net kik This is a DLL, which gets injected into the server exe. You will need Microsoft Detours library to compile this exploit...

Quake 3 Engine Client (Windows x86) - CS_ITEms Remote Overflow

Quake 3 Engine Client Windows x86 - CSITEms Remote Overflow / Quake 3 Engine Client CSITEMS Remote Stack Overflow Exploit Win32 Written by RunningBon E-Mail: [email protected] IRC: irc.rizon.net kik This is a DLL, which gets injected into the server exe. You will need Microsoft Detours library...

microsoft.autoroute.express.2000.txt

Date: Tue, 11 May 1999 12:25:21 +0100 BST From: Pete Mellor Subject: MS AutoRoute Express 2000 The following is taken from the BBC Watchdog web pages www.bbc.co.uk/watchdog. I would like to thank Gordon Brown for passing it to one of my colleagues. AutoRoute Express 2000 Weekend Watchdog 07.05.99...