DarkWidow

DarkWidow Un outil dropper personnalisable ciblant Windows. Mentions honorables : 1. BlackHat Asia, 2024 - Appel à outils 2. BlackHat USA, 2024 - Appel à outils 3. BlackHat SecTor, 2024 - Appel à outils 4. BlackHat Europe, 2024 - Appel à outils 5. Wild West Hacking Fest 2024 - Arsenal Un grand...

spawn

SPAWN - Cobalt Strike BOF Cobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks by spawning sacrificial process with Arbitrary Code Guard ACG, BlockDll, and PPID spoofing. Due to ACG, this does not support shellcode...

laZzzy

laZzzy laZzzy est un chargeur de shellcode qui démontre différentes techniques d'exécution couramment utilisées par les malwares. laZzzy a été développé en utilisant différentes bibliothèques open-source header-only. Fonctionnalités Appels système directs et fonctions natives Nt pas toutes les...

MalSeclogon

MalSeclogon Un petit outil pour jouer avec le service Seclogon. Détails techniques complets à : https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-2.html https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html Utilisation root@kitploit: MalSeclogon v0.2...

Ares

Project Ares Project Ares Injector Project Ares Injector est un chargeur de type Preuve de concept PoC écrit en C/C++ basé sur la technique Transacted Hollowing. Le chargeur injecte un PE dans un processus distant et propose les caractéristiques suivantes : Spoofing PPID CIG pour bloquer les...

SelectMyParent

これは何ですか これは親プロセススプーフィングのためのプロジェクトです。 使い方 ステップ1:親プロセスを選択し、pidを覚えておいてください ステップ2:以下のコマンドを実行して、親プロセススプーフィングを実施します root@kitploit: SelectMyParent.exe notepad 928 ステップ3:プロセスエクスプローラーを使用してプロセスツリーを表示すると、スプーフィングが成功したことを確認できます 参考 https://pentestlab.blog/2020/02/24/parent-pid-spoofing...

TerraLdr - A Payload Loader Designed With Advanced Evasion Features

TerraLdr: A Payload Loader Designed With Advanced Evasion Features Details: no crt functions imported syscall unhooking using KnownDllUnhook api hashing using Rotr32 hashing algo payload encryption using rc4 - payload is saved in .rsrc process injection - targetting 'SettingSyncHost.exe' ppid...

laZzzy - Shellcode Loader, Developed Using Different Open-Source Libraries, That Demonstrates Different Execution Techniques

laZzzy is a shellcode loader that demonstrates different execution techniques commonly employed by malware. laZzzy was developed using different open-source header-only libraries. Features Direct syscalls and native Nt functions not all functions but most Import Address Table IAT evasion Encrypte...

Shhhloader - SysWhispers Shellcode Loader

Shhhloader is a SysWhispers Shellcode Loader that is currently a Work in Progress. It takes raw shellcode as input and compiles a C++ stub that has been integrated with SysWhispers in order to bypass AV/EDR. The included python builder will work on any Linux system that has Mingw-w64 installed. T...

DInjector - Collection Of Shellcode Injection Techniques Packed In A D/Invoke Weaponized DLL

This repository is an accumulation of my code snippets for various shellcode injection techniques using fantastic D/Invoke API by @TheWover and @FuzzySecurity. Features: Fully ported to D/Invoke API Encrypted payloads which can be invoked from a URL or passed in base64 as an argument Built-in AMS...

Sharperner - Simple Executable Generator With Encrypted Shellcode

Sharperner is a tool written in CSharp that generate .NET dropper with AES and XOR obfuscated shellcode. Generated executable can possibly bypass signature check but I cant be sure it can bypass heuristic scanning. Features PE binary Process Hollowing PPID Spoofing Random generated AES key and iv...

TAU Threat Intelligence Notification: PPID Spoofing – Explorer CLSID

Summary Popular Attack Surface Reduction bypasses allow adversaries to hinder threat hunting activities by spoofing Parent Process ID. PPID to PID relationships have always been a key indicator of compromise and removing these conditions lead to false sense of security. Upon investigation its bee...

Windows Manage Process Migration

This module will migrate a Meterpreter session from one process to another. A given process PID to migrate to or the module can spawn one and migrate to that newly spawned process. This module requires Metasploit: https://metasploit.com/download Current source:...