BumbleCrypt

BumbleCrypt 一个受 Bumblebee 启发的 Crypter 背景 BumbleCrypt 的灵感源自 Bumblebee 的 crypter。在 Bumblebee 的案例中，主 Bumblebee DLL 被加载到内存中，并按以下方式执行： 解密并将 payload 写入 Heap（堆）中 Hook 三个 NtApi —— NtOpenFile、NtCreateSection 和 NtMapViewOfSection 调用 LoadLibraryW"gdiplus.dll"，这会触发 inline hooks，因为上述三个 API 会被 LoadLibrary...

UnCanny

UNCanny Coerce 这项研究的初衷很简单，因为我想找到属于自己的强制认证（coercion）技术。一开始我在寻找新的 RPC 攻击面，但在微软加入了 RPC 活动监控（https://techcommunity.microsoft.com/blog/microsoftdefenderatpblog/microsoft-defender-now-monitors-rpc-activity/4523368）之后，我决定换一条路。 UNCanny 就是那个兔子洞的产物。由于它的局限性，我不会认为它适合真正的红队作战，但我仍然认为这些笔记值得发表，供任何在这个领域深挖的人参考。...

Microsoft Office - COM Object DLL Planting with WMALFXGFXDSP.dll (MS16-007)

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=555 It is possible for an attacker to execute a DLL planting attack in Microsoft Office 2010 on Windows 7 x86 with a specially crafted OLE object. The attached POC docume...

Microsoft Office COM Object - WMALFXGFXDSP.dll DLL Planting (MS16-007)

Microsoft Office COM Object - WMALFXGFXDSP.dll DLL Planting MS16-007 Source: https://code.google.com/p/google-security-research/issues/detail?id=555 It is possible for an attacker to execute a DLL planting attack in Microsoft Office 2010 on Windows 7 x86 with a specially crafted OLE object. The...

Microsoft Vista - NtRaiseHardError Local Privilege Escalation

Microsoft Vista - NtRaiseHardError Local Privilege Escalation //raise.c //26-12-2006 erasmus/ORC //exploit NtRaiseHardError privesc and load dll into csrss //this version only is vista, other version can be worked //with proper offsets, i will complete them soon //imperfect but sometime work, ok...

Microsoft Vista (NtRaiseHardError) Privilege Escalation Exploit

Exploit for unknown platform in category local exploits =============================================================== Microsoft Vista NtRaiseHardError Privilege Escalation Exploit =============================================================== //raise.c //26-12-2006 erasmus/ORC //exploit...