BOF_RunPe

BOFRunPE BOF RunPE è un Beacon Object File per Cobalt Strike che esegue file PE interamente in memoria all'interno del processo del beacon. A differenza del tradizionale fork&run, nessun processo figlio viene generato, nessuna console viene creata e nessuna pipe viene utilizzata - tutto l'output...

Nim-RunPE

Nim-RunPE Un'implementazione in Nim di reflective PE-Loading dalla memoria. La base di questo codice è stata presa da RunPE-In-Memory - che ho portato in Nim. Dovrai installare le seguenti dipendenze: nimble install ptrmath winim Ho testato questo solo con Nim versione 1.6.2, quindi usa quella...

frida-extract

FridaExtract FridaExtract è uno strumento di estrazione basato su Frida.re per RunPE. L'iniezione di tipo RunPE è una tecnica comune usata dai malware per nascondere codice all'interno di un altro processo. Accade anche di essere la fase finale in molti packer : NOTA: Frida ora supporta anche...

nimcrypt

nimcrypt Nimcrypt is a .NET PE Crypter written in Nim, based entirely on the work of @byt3bl33d3r's OffensiveNim project: https://github.com/byt3bl33d3r/OffensiveNim This tool was inspired by @S3cur3Th1sSh1t's blog post a few months ago, as it's essentially just a full PoC of what he presented:...

RunPE

RunPE Caricatore riflessivo in C per binari non gestiti. Utilizzo root@kitploit: Usage: RunPE.exe e.g. RunPE.exe C:\Windows\System32\net.exe localgroup administrators Alternative usage: RunPE.exe ---f ---b ---a e.g: RunPE.exe ---f C:\Windows\System32\svchost.exe ---b ---a Opzioni di configurazion...

VBA-RunPE

VBA RunPE Descrizione Un'implementazione semplice ma efficace della tecnica RunPE in VBA. Questo codice può essere utilizzato per eseguire eseguibili dalla memoria di Word o Excel. È compatibile sia con le versioni a 32 bit che a 64 bit di Microsoft Office 2010 e successive. Maggiori informazioni...

MaldevAcademyLdr.2

MaldevAcademyLdr.2: RunPE-Implementierung mit mehreren Umgehungstechniken Quick Links Maldev Academy Home Maldev Academy Syllabus Maldev Academy Pricing !NOTE Obwohl dieses Repo verwendet werden kann, um andere Binärdateien auszuführen, lag der gesamte Fokus auf der Ausführung der mimikatz.exe...

OffensiveVBA - Code Execution And AV Evasion Methods For Macros In Office Documents

In preparation for a VBS AV Evasion Stream/Video I was doing some research for Office Macro code execution methods and evasion techniques. The list got longer and longer and I found no central place for offensive VBA templates - so this repo can be used for such. It is very far away from being...

Frida-Extract - Frida.re Based RunPE (And MapViewOfSection) Extraction Tool

FridaExtract is a Frida.re based RunPE extraction tool. RunPE type injection is a common technique used by malware to hide code within another process. It also happens to be the final stage in a lot of packers : NOTE: Frida now also supports extraction of injected PE files using the...

How to solve the Malwarebytes CrackMe: a step-by-step tutorial

The topic of this post is a Malwarebytes CrackMe—an exercise in malware analysis that I recently created. First, the challenge was created to serve internal purposes, but then it was released to the community on Twitter and triggered a lot of positive response. Thanks to all of you who sent in yo...

RunPE Extraction Tool: FridaExtract

FridaExtract is a Frida.re based RunPE extraction tool. RunPE type injection is a common technique used by malware to hide code within another process. It also happens to be the final stage in a lot of packers : NOTE: Frida now also supports extraction of injected PE files using the...

win32/xp [TR] sp3 MessageBox - shellcode 24 bytes

win32/xpTR sp3 MessageBox - 24Bytes Greetz : Bomberman&T-Rex Author : B3mB4m Proof : http://imgur.com/727ALiY I know there is nothing new.I wrote just to say "I am back" .. -Coming soon- arwin.c v2 .. Polymorphic shellcodes .. Win7,Win8,Win10 shellcodes .. RunPE & Migrate ? !!If bomberman allowed...