sRDI

sRDI - Shellcode Reflective DLL Injection sRDI allows for the conversion of DLL files to position independent shellcode. It attempts to be a fully functional PE loader supporting proper section permissions, TLS callbacks, and sanity checks. It can be thought of as a shellcode PE loader strapped t...

hollows_hunter

hollowshunter Hollows Hunter is a command-line application based on PE-sieve passive memory scanner. Recognizes and dumps a variety of potentially malicious implants replaced/implanted PEs, shellcodes, hooks, in-memory patches. While in case of PE-sieve you can select the process only by its PID,...

memhunter

Memhunter Automated hunting of memory resident malware at scale This project is WORK IN PROGRESS. Expect feature changes and binary releases on the upcoming weeks. Overview Memhunter is an endpoint sensor tool that is specialized in detecing resident malware, improving the threat hunter analysis...

pe-sieve

소개 PE-sieve 는 시스템에서 실행 중인 악성코드를 탐지하고, 추가 분석을 위해 잠재적으로 악의적인 자료를 수집하는 데 도움이 되는 도구입니다. 스캔된 프로세스 내에서 다양한 임플란트대체/주입된 PE, 셸코드, 후크 및 기타 메모리 패치를 인식하고 덤프합니다. 인라인 후크, 프로세스 할로잉, 프로세스 도펠갱잉, 리플렉티브 DLL 인젝션 등을 탐지합니다. PE-sieve는 한 번에 단일 프로세스 를 스캔하는 데 전념하는 경량 엔진 입니다. EXE 또는 DLL로 빌드할 수 있습니다. DLL 버전은 간단한 API를 제공하며 다...

doublepulsar-usermode-injector

DOUBLEPULSAR 사용자 모드 인젝터 저자: Matt Hillman [email protected] - @sp1nl0ck 회사: Countercept @countercept 웹사이트: https://countercept.com DOUBLEPULSAR 페이로드의 사용자 모드 셸코드를 사용하여 임의의 DLL을 다른 프로세스에 반사적으로 로드하는 유틸리티로, 탐지 기술 테스트 또는 기타 보안 연구에 사용됩니다. 배경 Shadow Brokers가 공개한 DOUBLEPULSAR 페이로드는 처음에 커널 모드에서 실행되며...

ReflectiveDLLInjection

개요 Reflective DLL 인젝션은 반사적 프로그래밍reflective programming 개념을 활용하여 호스트 프로세스의 메모리에서 라이브러리 로딩을 수행하는 라이브러리 인젝션 기법입니다. 즉, 라이브러리가 최소한의 PEPortable Executable 파일 로더를 구현하여 스스로를 로딩하는 역할을 담당합니다. 이를 통해 호스트 시스템 및 프로세스와의 최소한의 상호작용만으로 로딩 방식과 호스트와의 상호작용 방식을 제어할 수 있습니다. 이 인젝션은 해당 아키텍처가 지원되는 Windows NT4부터 Windows 8까...

Cooolis-ms

Cooolis-ms Wiki Documentation Cooolis-ms is a code execution tool that includes a Metasploit Payload Loader, Cobalt Strike External C2 Loader, and Reflective DLL injection. It is designed to evade static detection of code we intend to execute that contains known signatures, helping red team...

maalik

Maalik Network Pivoting and Post Exploitation Framework. Features Console Features Desktop notification on new session. Kill Online session easily. Build Maalik Client, Fhdawn easily. Configurable values in settings.ini Root shell. Multithreaded, Get multiple sessions. Maalik is extremenly easy t...

Metasploit Weekly Wrap-Up

Throw another log file on the fire Our own Stephen Fewer authored a module targeting CVE-2023-26360 affecting ColdFusion 2021 Update 5 and earlier as well as ColdFusion 2018 Update 15 and earlier. The vulnerability allows multiple paths to code execution, but our module works by leveraging a...

Lenovo Diagnostics Driver Memory Access Exploit

This Metasploit module demonstrates how an incorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to issue device IOCTLs to perform arbitrary physical/virtual memory reads and writes. This module requires Metasploit: https://metasploit.com/download...

DCOM abuse and lateral movement with Cobalt Strike

Introduction When researching lateral movement techniques I came across a post from Raphael Mudge of Cobalt Strike fame. He details scripting an Aggressor Script for Matt Nelson’s MMC20.Application Lateral Movement technique. Reading that post spurred me to make my own DCOM based lateral movement...

Injector - Complete Arsenal Of Memory Injection And Other Techniques For Red-Teaming In Windows

Complete Arsenal of Memory injection and other techniques for red-teaming in Windows What does Injector do? Process injection support for shellcode located at remote server as well as local storage. Just specify the shellcode file and it will do the rest. It will by default inject into notepad.ex...

FalconEye - Real-time detection software for Windows process injections

FalconEye is a windows endpoint detection software for real-time process injections. It is a kernel-mode driver that aims to catch process injections as they are happening real-time. Since FalconEye runs in kernel mode, it provides a stronger and reliable defense against process injection...

Microsoft Windows TokenMagic Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Privilege Escalation via TokenMagic UAC Bypass', 'Description' = %q This module leverages a UAC bypass TokenMagic in order to spawn a...

ExecuteAssembly - Load/Inject .NET Assemblies

ExecuteAssembly is an alternative of CS execute-assembly, built with C/C++ and it can be used to Load/Inject .NET assemblies by; reusing the host spawnto process loaded CLR Modules/AppDomainManager, Stomping Loader/.NET assembly PE DOS headers, Unlinking .NET related modules, bypassing ETW+AMSI,...

NTLM BITS SYSTEM Token Impersonation Exploit

This Metasploit module exploit BITS behavior which tries to connect to the local Windows Remote Management server WinRM every times it starts. The module launches a fake WinRM server which listen on port 5985 and triggers BITS. When BITS starts, it tries to authenticate to the Rogue WinRM server,...

NTLM BITS SYSTEM Token Impersonation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/post/windows/reflectivedllinjection' class MetasploitModule 'SYSTEM token impersonation through NTLM bits authentication on missing WinRM Service.',...

Microsoft Windows DrawIconEx Local Privilege Escalation Exploit

This Metasploit module exploits CVE-2020-1054, an out of bounds write reachable from DrawIconEx within win32k. The out of bounds write can be used to overwrite the pvbits of a SURFOBJ. By utilizing this vulnerability to execute controlled writes to kernel memory, an attacker can gain arbitrary co...

Chinese APT group targets India and Hong Kong using new variant of MgBot malware

This blog post was authored by Hossein Jazi and Jérôme Segura On July 2, we found an archive file with an embedded document pretending to be from the government of India. This file used template injection to drop a malicious template which loaded a variant of Cobalt Strike. One day later, the sam...

SYSTEM token impersonation through NTLM bits authentication on missing WinRM Service.

This module exploit BITS behavior which tries to connect to the local Windows Remote Management server WinRM every times it starts. The module launches a fake WinRM server which listen on port 5985 and triggers BITS. When BITS starts, it tries to authenticate to the Rogue WinRM server, which allo...