Memory-analysis

Memory-analysis Contains tools to perform malware and forensic analysis in Memory. Plugins: Dyrescan.py - parses Dyreconfig in memory. Rat9002.py - parses 9002 rat config in memory. plugx.py - parses plugx config in memory modified to also parse config size: 0x170c. ghostrat.py - parses ghostrat...

DeadMatter

DeadMatter DeadMatter is a specialized tool written in C, designed to extract sensitive information, such as password hashes of active logon sessions, from memory dumps. It employs carving techniques to retrieve credentials from various file types, such as process or full memory dumps, either in...

Netgrave

Netgrave A tool for retrieving login credentials from Netwave IP cameras using a memory dump vulnerability CVE-2018-17240. This project was inspired by expcamera and offers performance and efficiency improvements. This tool works for all platforms as it does not use any Linux CLI tools through...

BSOD_bitlocker_recover

BitLocker VMK Carving Tool This Python script helps you extract potential BitLocker Volume Master Keys VMKs from memory dump files, such as those generated by a Blue Screen of Death BSOD. It's a command-line utility designed to assist in forensic investigations where BitLocker encryption is...

linux_screenshot_xwindows

Intro The goal of this volatility plugin is to extract a screenshot of all open X windows from a memory dump. Previous work The volatility plugin linuxxwindows realised by Adam Bridge https://github.com/bridgeythegeek/linuxxwindows extracts various metadata from the window objects registered to X...

keepass-exfil-forensics

KeePass Memory Exfiltration — Network Forensics Investigation Recovers exfiltrated data from PCAP traffic by reversing a hex → Base64 → XOR obfuscation chain used in a real DFIR CTF scenario TryHackMe, then exploits CVE-2023-32784 to recover a KeePass master password straight from a process memor...

keepass_dump

Keepass-Dumper This is my PoC implementation for CVE-2023-32784 My version is a python port of @vdohney's PoC along with a few changes and additional features. Changes One change, was to use known strings that can be found within the dump file in order to more accurately jump to the location of t...

interrogate

Interrogate Interrogate is a proof-of-concept tool for identification of cryptographic keys in binary material regardless of target operating system, first and foremost for memory dump analysis and forensic usage. Able to identify AES, Serpent, Twofish and DER-encoded RSA keys as of version 0.0.4...

Dumpy

Description This tool dynamically calls MiniDumpWriteDump to dump lsass memory content. This process is done without opening a new process handle to lsass and using DInvokers to make it harder to detect its malicious behaviour. In order to obtain a valid process handle without calling OpenProcess...

fitness-app

Fitbit Open Source Android App This app is based on the work of Jiska Classen, Matthias Hanreich, Steffen Kreis, Tobias Krichel, Johannes Riedel and Sven Ströher. Features Scan for BLE Fitbit devices Authenticate against Fitbit server like the original app Obtain authentication credentials from t...

cve-2023-32784

CVE-2023-32784 KeePass 2.X version 2.54 is susceptible to a vulnerability in which the master password may be retrievable from a memory dump of an unlocked KeePass database. This was assigned CVE-2023-32784 This program aims to retrieve the master password from a memory dump of a running KeePass...

CVE-2024-33901-ProofOfConcept

CVE-2024-33901-ProofOfConcept Short program that demonstrates the vulnerability CVE-2024-33901 in KeePassXC version 2.7.7 The report for the class might need the source code linked, so that's why I created the repo for this How to replicate the vulnerability 1. Open KeePassXC and authenticate the...

CVE-2023-32784-keepass-linux

KeePass 2.53/cmdline files and store the pid of ones with the keyword KeePass in their commandline argument. It'll then acquire the adresses of memory maps in /proc//maps that aren't directly associated with a library, meaning they have an empty file path. It'll then store the memory of all those...

memOptix

memOptix This Jupyter notebook was created to assist DFIR professionals with triaging Windows memory dumps. Please note that this notebook was created based on the output generated from CrowdStrike's Supermem python script https://github.com/CrowdStrike/SuperMem. SuperMem triage mode 2 or 3 shoul...

Lsass-Shtinkering

Lsass Shtinkering New method of dumping LSASS by abusing the Windows Error Reporting service. It sends a message to the service with the ALPC protocol to report an exception on LSASS. This report will cause the service to dump the memory of LSASS. Prerequisites The registry value "DumpType" under...

DMA-ProcessDumper

DMA-ProcessDumper Dumps entire memory of target process on the user-mode using DMA with MemProcFS over a PCIe FPGA device Building Copy leechcore.h, vmmdll.h and vmm.lib from MemProcFS into the DMA-ProcessDumper directory Compile using Visual Studio Copy leechcore.dll, vmm.dll and FTD3XX.dll from...

KeePass-CVE-2023-32784-Exploitation-and-Defense

KeePass Memory Leak Vulnerability CVE-2023-32784:Exploitation & Defense Architecture Objective To analyse the CVE-2023-32784 vulnerability in KeePass Password Safe v2.53, demonstrate master password extraction via memory dumping, and engineer robust detection and mitigation controls. The...

LsassReflectDumping

LsassReflectDumping This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone is created, it utilizes MINIDUMPCALLBACKINFORMATION callbacks to generate a memory dump of the cloned process. Steps Getting the handle of...

Tenda-F3-V4

Tenda F3 Router Exploit & File Downloader This project is a tool for downloading various files from the Tenda F3 router v3/v4 through an unauthenticated vulnerability CVE-2020-35391. It allows you to get the configuration file, system log, and flash dump from a vulnerable router. Overview The...

PPLdump

PPLdump ⚠️ 2022-07-24 - As of Windows 10 21H2 10.0.19044.1826 July 2022 update, the exploit implemented in PPLdump no longer works. A patch in NTDLL now prevents PPLs from loading Known DLLs. More information here. This tool implements a userland exploit that was initially discussed by James...