go-shellcode

go-shellcode go-shellcode is a repository of Windows Shellcode runners and supporting utilities. The applications load and execute Shellcode using various API calls or techniques. The available Shellcode runners include: CreateFiber CreateProcess CreateProcessWithPipe CreateRemoteThread...

SharpHook

SharpHook SharpHook is inspired by the SharpRDPThief project, It uses various API hooks in order to give us the desired credentials. In the background it uses the EasyHook project, Once the desired process is up and running SharpHook will automatically inject its dependencies into the target...

shad0w

SHAD0W SHAD0W 是一个模块化 C2 框架，旨在成功运行于成熟环境中。 它采用多种方法规避 EDR 和 AV，同时允许操作者继续使用他们熟悉的工具和技术。它由 Python 3.8 和 C 驱动，并使用 Donut 生成有效载荷。通过结合 Donut 与 SHAD0W 的进程注入能力，操作者可以在内存中完全执行 .NET 程序集、DLL、EXE、JS、VBS 或 XSL。大量使用动态解析的系统调用来避免用户态 API 挂钩，利用反 DLL 注入技术使 EDR 难以将其代码加载到信标中，并采用官方 Microsoft 缓解方法来保护生成的进程。 安装与使用说明请参阅 wiki。...

AudioServer-Voip-Recorder

Goal: Demonstrate VoIP stream capture by hooking Android's audioserver specifically libaudioflinger.so and recording uplink mic and downlink speaker PCM buffers when the system is in communication mode. Project Design & Methodology Architecture: Controller App Android UI with 9 buttons to manage...

doublepulsar-usermode-injector

Author: Matt Hillman [email protected] - @sp1nl0ck Company: Countercept @countercept Website: https://countercept.com A utility to use the usermode shellcode from the DOUBLEPULSAR payload to reflectively load an arbitrary DLL into another process, for use in testing detection techniques or...

process-injection-playground

Linux Process Injection Playground A comprehensive collection of process injection techniques for Linux, demonstrating various methods of injecting code into running processes. These examples are intended for educational purposes, security research, and understanding low-level Linux process...

MalwareForge---Advanced-Static-Malware-Analyzer

🛡️ MalwareForge - Advanced Static Malware Analyzer MalwareForge is a powerful static malware analysis tool that detects malicious behavior without executing the file. ✨ Features 🦠 Behavior Analysis : Process Injection, Persistence, Network, Stealer, Evasion 💉 8 Injection Techniques : Process...

ThreadlessInject

Threadless Process Injection From my Bsides Cymru 2023 talk: Needles Without the Thread. As red teamers, we always find ourselves in a cat and mouse game with the blue team. Many Anti-virus and EDR solutions over the past 10 years have become significantly more advanced at detecting fileless...

Dirty-Vanity

Dirty Vanity A POC for the new injection technique, abusing windows fork API to evade EDRs. Usage DirtyVanity.exe TARGETPIDTOREFLECT Runtime steps Allocate and write shellcode to TARGETPIDTOREFLECT Fork TARGETPIDTOREFLECT to a new process Set the forked process's start address to the cloned...

CobaltWhispers

CobaltWhispers Author: @Cerbersec CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files for Cobalt Strike to perform process injection, persistence and more, leveraging direct syscalls to bypass EDR/AV. CobaltWhispers is powered by SysWhispers2 and InlineWhispers...

Split

Description Divide and Conquer is an algorithm that is commonly applied in programming to solve a complex problem by dividing it into many simpler sub-problems. We can apply this approach to offensive security with a different goal: confuse EDRs so they lose track of our activities, preventing th...

DInvoke

DInvoke Dynamic replacement for PInvoke on Windows. DInvoke contains powerful primitives that may be combined intelligently to dynamically invoke unmanaged code from disk or from memory with careful precision. This may be used for many purposes such as PE parsing, intelligent dynamic API...

process-inject-kit

Process Inject Kit This is a port of Cobalt Strike's Process Inject Kit from C to the C++ BOF template. How it works The built in fork and run process injection techniques can be change with the PROCESSINJECTSPAWN and PROCESSINJECTEXPLICIT hooks. This repo provides the following: Source code...

ChromeKatz

ChromeKatz ChromeKatz is a solution for dumping sensitive information from memory of Chromium based browsers. As for now, ChromeKatz consists of three projects: 1. CookieKatz - The cookie dumper 2. CredentialKatz - Deprecated.. for now 3. ElevationKatz - Get the decryption key from the elevation...

Christmas

Maldev Academy Maldev Academy Home Maldev Academy Syllabus Christmas Implementing an injection method mentioned by @Hexacorn. This PoC creates multiple processes, where each process performs a specific task as part of the injection operation. Each child process will spawn another process and pass...

RemoteDLLInjector

Introducción Esta es una herramienta que se puede utilizar para la inyección de DLL： Desde el momento en que RemoteDLLInjector se ejecuta, proporcionará los pasos completos que realiza para lograr la inyección de DLL. Si la DLL se inyecta correctamente, devolverá una sesión de meterpreter con los...

invoker

Invoker 渗透测试工具与反病毒评估工具。 使用 Visual Studio Community 2022 v17.5.4（64位）构建，并在 Windows 10 企业版操作系统（64位）上测试。 仅用于教育目的。希望它能有所帮助！ 该仓库已有已知签名，且我没有时间每次都上传新的可执行文件，因此您应自行编译此项目。 有用的网站： elastic.co learn.microsoft.com processhacker.sourceforge.io undocumented.ntinternals.net pinvoke.net 待办事项： 使进程幽灵化与 x86 架构兼容，因为...

dvenom

🐍 Double Venom DVenom Double Venom DVenom is a tool that helps red teamers bypass AVs by providing an encryption wrapper and loader for your shellcode. 🚀 Features 🛡️ Capable of bypassing some well-known antivirus AVs. 🔒 Offers multiple encryption methods including RC4, AES256, XOR, and ROT. 🏗️...

DataInject-BOF

Data Inject BOF A beacon object file implementation of the process injection proof-of-concept from my blog post Control Flow Hijacking via Data Pointers. Hijacks control flow via overwriting combase.dll's Control Flow Guard function pointers called by COM proxying functions. Important Notes From ...

DatajackProxy

Datajack Proxy Datajack Proxy a tool to intercept non-HTTP traffic between a native application and a server. This would allow for communications interception and modification, even if encryption and certificate pinning were in use. This is done by hooking the application and intercepting calls t...