pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

BokuLoader

BokuLoader : Cobalt Strike Reflective Loader A proof-of-concept User-Defined Reflective Loader UDRL which aims to recreate, integrate, and enhance Cobalt Strike's evasion features! Contributors:...

AceLdr

AceLdr - Avoid Memory Scanners A position-independent reflective loader for Cobalt Strike. Zero results from Hunt-Sleeping-Beacons, BeaconHunter, BeaconEye, Patriot, Moneta, PE-sieve, or MalMemDetect. Features Easy to Use Import a single CNA script before generating shellcode. Dynamic Memory...

CrabLoader

CrabLoader 一个完全用 Rust 编写的 Cobalt Strike 用户自定义反射加载器。我只是想看看构建这东西有多难。结果发现并不难。我可能会在某个时候添加睡眠混淆功能。目前，它只是一个没有任何特殊功能的基础加载器。唯一具有“操作安全”考量的功能是它从不在任何阶段使用 RWX 页面。 用法 下载发布版并加载 .cna 文件。 你也可以自己编译。确保使用 MSVC 工具链和 release 配置。你可以使用附带的 extractor 来提取加载器的 .text 节。例如： root@kitploit: cd extractor cargo run --release --...

CustomC2ChannelTemplate

用于自定义C2通道的IAT钩子 这是一个简单的概念验证和模板，用于开发Cobalt Strike的自定义C2通道，通过反射加载器应用IAT钩子。 博客文章：https://codex-7.gitbook.io/codexs-terminal-window/red-team/cobalt-strike/building-custom-c2-channels-by-hooking-wininet TCP通道的演示动图 使用方法 customCallback.h、hook.c、hash.h和hook.h文件是粗略的模板，但它们可以放入Crystal...

Astral_Projection

Astral Projection - UDRL Astral Projectionは、Cobalt StrikeのUDRL（ユーザー定義リフレクティブローダー）であり、高度なモジュールストンピングを実行します。...

patriot

Patriot Small research project for detecting various kinds of in-memory stealth techniques. Download the latest release here. The current version supports the following detections: Suspicious CONTEXT structures pointing to VirtualProtect functions. Targets research by Austin Hudson Foliage and Ek...

KaynStrike

KaynStrike 一种用于 Cobalt Strike Beacon 的用户自定义反射加载器，可伪装线程起始地址，并在入口点执行后释放自身。 线程起始地址欺骗 反射加载器清理 证明 如何使用 只需加载 KaynStrike.cna Aggressor 脚本，并构建一个无阶段 beacon（已作为 exe 测试过） 致谢 S4ntiagoP。从他的一条推文中获得了释放反射加载器的想法 Austin Hudson（又名 SecIdiot）。反射加载器设计与 ROP 链...

BokuLoader

BokuLoader：Cobalt Strike 反射加载器 这是一个概念验证的用户自定义反射加载器（UDRL），旨在重现、集成并增强 Cobalt Strike 的规避功能！ 贡献者：...

RunPE

RunPE 用于非托管二进制文件的 C 反射加载器。 用法 root@kitploit: Usage: RunPE.exe e.g. RunPE.exe C:\Windows\System32\net.exe localgroup administrators Alternative usage: RunPE.exe ---f ---b ---a e.g: RunPE.exe ---f C:\Windows\System32\svchost.exe ---b ---a 构建配置选项 编辑编译符号以快速调整程序流程： 在 Visual Studio 中右键单击项目 - 属性 - 生成 -...

freeBokuLoader

freeBokuLoader 一个简单的 BOF，尝试释放存储用户定义反射加载器（User Defined Reflective Loader）的内存区域。 顾名思义，它在 BokuLoader 上进行了测试，但应该适用于大多数（如果不是全部）UDRL。 用法 root@kitploit: beacon freeBokuLoader...

AtlasLdr

Atlas 是一个反射式 x64 加载器，具有以下功能： 功能 从远程服务器获取 DLL 和 PE 在远程进程中手动映射 擦除 DOS Header 和 NTHeader 的 Magic 字节 位置无关代码 使用间接系统调用 ZwOpenProcess ZwAllocateVirtualMemory ZwProtectVirtualMemory ZwQuerySystemInformation ZwFreeVirtualMemory ZwCreateThreadEx 所有系统调用共用一个 Stub 动态获取 SSN 动态解析系统调用地址 Atlas 还使用 LdrLoadDll...

ProcessStomping - A Variation Of ProcessOverwriting To Execute Shellcode On An Executable'S Section

A variation of ProcessOverwriting to execute shellcode on an executable's section What is it For a more detailed explanation you can read my blog post Process Stomping, is a variation of hasherezade’s Process Overwriting and it has the advantage of writing a shellcode payload on a targeted sectio...

Windows Inject Reflective PE Files, Bind TCP Stager (RC4 Stage Encryption, Metasm)

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...

Windows Inject PE Files, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...

Windows Inject PE Files, Reverse TCP Stager

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...

Windows Inject PE Files, Find Tag Ordinal Stager

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...

Windows Inject PE Files, Bind IPv6 TCP Stager (Windows x86)

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...

Windows Inject PE Files, Hidden Bind Ipknock TCP Stager

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...

Windows Inject PE Files, Bind TCP Stager (Windows x86)

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...