Lucene search
+L

23 matches found

Kitploit
Kitploit
added 2026/09/16 3:06 a.m.10 views

ScreenshotBOF

ScreenshotBOF An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot downloaded in memory. Features JPEG compression In memory download as screenshot or as file Supports capturing of minimized windows Grayscale, JPEG quality and...

6.1AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/16 1:18 a.m.16 views

thats_no_pipe

Thats no pipe Frida-based project to intercept Windows named pipe communication Objectives This project aims at intercepting IPC communications by hooking specific WinAPI functions and forwarding them to an HTTP proxy using a websocket. Architecture Read from and write to a named pipe can happen ...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/15 8:16 p.m.13 views

LightsOut

LightsOut LightsOut will generate an obfuscated DLL that will disable AMSI & ETW while trying to evade AV. This is done by randomizing all WinAPI functions used, xor encoding strings, and utilizing basic sandbox checks. Mingw-w64 is used to compile the obfuscated C code into a DLL that can be...

6.5AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/15 8:12 p.m.8 views

dll-injector

About As the name suggests, the application primarily performs injecting a DLL into any process running on Windows. With the power of this, it is able to perform several operations on a process such as loading a DLL, unloading a DLL, and hooking primary WinAPI functions e.g., CreateFileW, ReadFil...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 3:21 p.m.7 views

MalwareApiLibrary

MalwareApiLibrary:用于恶意软件开发的一组 API: StringManagementLib:管理字符串、字符串哈希等 WinApiManagementLib:替代 GetModuleHandle 和 GetProcAddress 函数 SyscallsManagementLib:运行 Hellsgate、TartarusGate、PerunsFart(目前)以解除对系统调用的挂钩 参考: VX-API 待办事项: 反调试库 载荷执行库 持久化库 修复任何错误 完成后清理整个项目 注意:在对代码进行小幅更新后,我不会更新 release...

5.7AI score
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/12 3:01 p.m.12 views

AntiDebug-AntiVM

AntiDebug/AntiVM 用途 本仓库收录了我在翻阅 WinAPI 时遇到的各种调试/虚拟机检测方法。此仓库并非用于编译和运行,而是展示如何将这些不同方法实现到您现有项目中的示例。AntiDebug 和 AntiVM 文件夹中的每个文件都可以独立查看,这也是使用 GetModuleHandle 的原因。...

5.8AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/11 9:48 p.m.9 views

OffensiveCpp

OffensiveCpp Offensive C++ es una colección de fragmentos de seguridad ofensiva escritos en C++. Incluye varias herramientas para pruebas de penetración y desarrollo de exploits. Tabla de Contenidos OffensiveCpp Introducción ¿Por qué C/C++? Compilación Bibliotecas de Referencia Contribuciones...

5.8AI score
SaveExploits0
Kitploit
Kitploit
added 2023/11/19 11:30 a.m.68 views

LightsOut - Generate An Obfuscated DLL That Will Disable AMSI And ETW

LightsOut will generate an obfuscated DLL that will disable AMSI & ETW while trying to evade AV. This is done by randomizing all WinAPI functions used, xor encoding strings, and utilizing basic sandbox checks. Mingw-w64 is used to compile the obfuscated C code into a DLL that can be loaded into a...

8.1AI score
SaveExploits0References4
The Hacker News
The Hacker News
added 2023/08/17 4:15 p.m.72 views

NoFilter Attack: Sneaky Privilege Escalation Method Bypasses Windows Security

A previously undetected attack method called NoFilter has been found to abuse the Windows Filtering Platform WFP to achieve privilege escalation in the Windows operating system. "If an attacker has the ability to execute code with admin privilege and the target is to perform LSASS Shtinkering,...

7.8AI score
SaveExploits0
The Hacker News
The Hacker News
added 2022/11/02 11:28 a.m.111 views

Inside Raccoon Stealer V2

Raccoon Stealer is back on the news again. US officials arrested Mark Sokolovsky, one of the malware actors behind this program. In July 2022, after several months of the shutdown, a Raccoon Stealer V2 went viral. Last week, the Department of Justice's press release stated that the malware...

0.3AI score
SaveExploits0
Kitploit
Kitploit
added 2022/01/13 11:30 a.m.51 views

Scemu - X86 32bits Emulator, For Securely Emulating Shellcodes

x86 32bits emulator, for securely emulating shellcodes. Features  rust safety, good for malware. All dependencies are in rust. zero unsafe blocks. very fast emulation much faster than unicorn 3,000,000 instructions/second 100,000 instructions/second printing every instruction -vv. powered by...

7.1AI score
SaveExploits0References12
Kitploit
Kitploit
added 2021/11/22 11:30 a.m.35 views

ThreadBoat - Program Uses Thread Execution Hijacking To Inject Native Shell-code Into A Standard Win32 Application

Program uses Thread Hijacking to Inject Native Shellcode into a Standard Win32 Application. About I developed this small project to continue my experiences of different code injection methods and to allow RedTeam security professionals to utilize this method as a unique way to perform software...

7.9AI score
SaveExploits0References1
exploitpack
exploitpack
added 2019/12/03 12:00 a.m.36 views

NetProfiler

On .NET 4, the CLSID must be defined via the HKCR\CLSIDGUID\InprocServer32 registry key containing the path to the profiling DLL. On recent versions, the CLR uses the CORPROFILERPATH environment variable to find the DLL – and falls back to using the CLSID if CORPROFILERPATH is not defined. Author...

1.1AI score
SaveExploits0
Kitploit
Kitploit
added 2019/10/03 8:57 p.m.128 views

ThreadBoat - Program Uses Thread Execution Hijacking To Inject Native Shellcode Into A Standard Win32 Application

Program uses Thread Hijacking to Inject Native Shellcode into a Standard Win32 Application. With Thread Hijacking, it allows the hijacker.exe program to suspend a thread within the target.exe program allowing us to write shellcode to a thread. Usage int main System sys; Interceptor incp; Exceptio...

7.2AI score
SaveExploits0References1
Securelist
Securelist
added 2019/06/18 10:00 a.m.175 views

Plurox: Modular backdoor

In February this year, a curious backdoor passed across our virtual desk. The analysis showed the malware to have a few quite unpleasant features. It can spread itself over a local network via an exploit, provide access to the attacked network, and install miners and other malicious software on...

7.1AI score
SaveExploits0
Securelist
Securelist
added 2018/05/07 10:00 a.m.106 views

SynAck targeted ransomware uses the Doppelgänging technique

The Process Doppelgänging technique was first presented in December 2017 at the BlackHat conference. Since the presentation several threat actors have started using this sophisticated technique in an attempt to bypass modern security solutions. In April 2018, we spotted the first ransomware...

7.2AI score
SaveExploits0
Packet Storm
Packet Storm
added 2017/11/12 12:00 a.m.96 views

Symantec Endpoint Protection 12.1.6 Tamper Protection Bypass

Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-6331-SYMANTEC-ENDPOINT-PROTECTION-TAMPER-PROTECTION-BYPASS.txt + ISR: ApparitionSec Vendor: ======= www.symantec.com Product: =========== Symantec Endpoint...

7AI score0.01687EPSS
SaveExploits5
Exploit DB
Exploit DB
added 2017/11/10 12:00 a.m.85 views

Symantec Endpoint Protection 12.1 - Tamper-Protection Bypass

Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-6331-SYMANTEC-ENDPOINT-PROTECTION-TAMPER-PROTECTION-BYPASS.txt + ISR: ApparitionSec Vendor: ======= www.symantec.com Product: =========== Symantec Endpoint...

7.1CVSS7.2AI score0.01687EPSS
SaveExploits5
exploitpack
exploitpack
added 2017/11/10 12:00 a.m.81 views

Symantec Endpoint Protection 12.1 - Tamper-Protection Bypass

Symantec Endpoint Protection 12.1 - Tamper-Protection Bypass + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-6331-SYMANTEC-ENDPOINT-PROTECTION-TAMPER-PROTECTION-BYPASS.txt + ISR: ApparitionSec Vendor: =======...

3.6CVSS7AI score0.01687EPSS
SaveExploits5
n0where
n0where
added 2017/04/10 4:36 a.m.265 views

Pentesting Active Directory Environments: CrackMapExec

Pentesting Active Directory Environments: CrackMapExec CrackMapExec a.k.a CME is a post-exploitation tool that helps automate assessing the security of large Active Directory networks. Built with stealth in mind, CME follows the concept of “Living off the Land”: abusing built-in Active Directory...

0.1AI score
SaveExploits0References5
Rows per page
Query Builder