LightsOut

LightsOut LightsOutは、難読化されたDLLを生成し、AMSI & ETWを無効にしつつ、AVの検知を回避しようとします。これは、使用されるすべてのWinAPI関数をランダム化し、文字列をXORエンコードし、基本的なサンドボックスチェックを利用することで行われます。Mingw-w64を使用して、難読化されたCコードをコンパイルし、AMSIまたはETWが存在する任意のプロセス（例：PowerShell）にロードできるDLLにします。...

dll-injector

关于 顾名思义，该应用主要功能是将DLL注入到Windows上运行的任何进程中。凭借这一能力，它可以对进程执行多种操作，例如加载DLL、卸载DLL以及挂钩主要的WinAPI函数（例如 CreateFileW、ReadFile 等）。 其前端使用 Flutter 构建，核心功能使用 C++ 实现。该项目弥补了简化且有效的Windows进程调试和行为修改工具的可用性缺口。当前现有工具要么因复杂性而缺乏用户可访问性，要么无法提供足够的功能来实现全面的系统级操作。 功能 列出所有正在运行的进程、选择目标进程并注入DLL 支持挂钩特定的Windows API函数并实时修改参数...

ScreenshotBOF

ScreenshotBOF Cobalt Strike向けの代替スクリーンショット機能で、WinAPIを使用し、fork & runを実行しません。スクリーンショットはメモリ上でダウンロードされます。 機能 JPEG圧縮 メモリ上でのスクリーンショットまたはファイルとしてのダウンロード 最小化されたウィンドウのキャプチャをサポート グレースケール、JPEG品質、ダウンスケーリングによるファイルサイズ削減 自己コンパイル 1. リポジトリをgit cloneする 2. makeを実行する 保存方法: 0. ファイルをディスクに保存 1. beacon経由でファイルをダウンロード（Cobal...

thats_no_pipe

那不是管道 基于 Frida 的项目，用于拦截 Windows 命名管道通信 目标 本项目旨在通过 Hook 特定的 WinAPI 函数，并使用 WebSocket 将其转发到 HTTP 代理，从而拦截 IPC 通信。 架构 对命名管道的读取和写入可能发生在不同的函数中。在本节中，WriteFile 表示对命名管道的写入，ReadFile 表示对命名管道的读取。 被拦截时，待写入的数据遵循以下模式。 root@kitploit: WriteFile -- frida hook -- python process -- websocket client -- HTTP Proxy --...

MalwareApiLibrary

MalwareApiLibrary：用于恶意软件开发的一组 API： StringManagementLib：管理字符串、字符串哈希等 WinApiManagementLib：替代 GetModuleHandle 和 GetProcAddress 函数 SyscallsManagementLib：运行 Hellsgate、TartarusGate、PerunsFart（目前）以解除对系统调用的挂钩 参考： VX-API 待办事项： 反调试库 载荷执行库 持久化库 修复任何错误 完成后清理整个项目 注意：在对代码进行小幅更新后，我不会更新 release...

AntiDebug-AntiVM

AntiDebug/AntiVM 用途 本仓库收录了我在翻阅 WinAPI 时遇到的各种调试/虚拟机检测方法。此仓库并非用于编译和运行，而是展示如何将这些不同方法实现到您现有项目中的示例。AntiDebug 和 AntiVM 文件夹中的每个文件都可以独立查看，这也是使用 GetModuleHandle 的原因。...

OffensiveCpp

OffensiveCpp Offensive C++ es una colección de fragmentos de seguridad ofensiva escritos en C++. Incluye varias herramientas para pruebas de penetración y desarrollo de exploits. Tabla de Contenidos OffensiveCpp Introducción ¿Por qué C/C++? Compilación Bibliotecas de Referencia Contribuciones...

LightsOut - Generate An Obfuscated DLL That Will Disable AMSI And ETW

LightsOut will generate an obfuscated DLL that will disable AMSI & ETW while trying to evade AV. This is done by randomizing all WinAPI functions used, xor encoding strings, and utilizing basic sandbox checks. Mingw-w64 is used to compile the obfuscated C code into a DLL that can be loaded into a...

NoFilter Attack: Sneaky Privilege Escalation Method Bypasses Windows Security

A previously undetected attack method called NoFilter has been found to abuse the Windows Filtering Platform WFP to achieve privilege escalation in the Windows operating system. "If an attacker has the ability to execute code with admin privilege and the target is to perform LSASS Shtinkering,...

Inside Raccoon Stealer V2

Raccoon Stealer is back on the news again. US officials arrested Mark Sokolovsky, one of the malware actors behind this program. In July 2022, after several months of the shutdown, a Raccoon Stealer V2 went viral. Last week, the Department of Justice's press release stated that the malware...

Scemu - X86 32bits Emulator, For Securely Emulating Shellcodes

x86 32bits emulator, for securely emulating shellcodes. Features  rust safety, good for malware. All dependencies are in rust. zero unsafe blocks. very fast emulation much faster than unicorn 3,000,000 instructions/second 100,000 instructions/second printing every instruction -vv. powered by...

ThreadBoat - Program Uses Thread Execution Hijacking To Inject Native Shell-code Into A Standard Win32 Application

Program uses Thread Hijacking to Inject Native Shellcode into a Standard Win32 Application. About I developed this small project to continue my experiences of different code injection methods and to allow RedTeam security professionals to utilize this method as a unique way to perform software...

NetProfiler

On .NET 4, the CLSID must be defined via the HKCR\CLSIDGUID\InprocServer32 registry key containing the path to the profiling DLL. On recent versions, the CLR uses the CORPROFILERPATH environment variable to find the DLL – and falls back to using the CLSID if CORPROFILERPATH is not defined. Author...

ThreadBoat - Program Uses Thread Execution Hijacking To Inject Native Shellcode Into A Standard Win32 Application

Program uses Thread Hijacking to Inject Native Shellcode into a Standard Win32 Application. With Thread Hijacking, it allows the hijacker.exe program to suspend a thread within the target.exe program allowing us to write shellcode to a thread. Usage int main System sys; Interceptor incp; Exceptio...

Plurox: Modular backdoor

In February this year, a curious backdoor passed across our virtual desk. The analysis showed the malware to have a few quite unpleasant features. It can spread itself over a local network via an exploit, provide access to the attacked network, and install miners and other malicious software on...

SynAck targeted ransomware uses the Doppelgänging technique

The Process Doppelgänging technique was first presented in December 2017 at the BlackHat conference. Since the presentation several threat actors have started using this sophisticated technique in an attempt to bypass modern security solutions. In April 2018, we spotted the first ransomware...

Symantec Endpoint Protection 12.1.6 Tamper Protection Bypass

Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-6331-SYMANTEC-ENDPOINT-PROTECTION-TAMPER-PROTECTION-BYPASS.txt + ISR: ApparitionSec Vendor: ======= www.symantec.com Product: =========== Symantec Endpoint...

Symantec Endpoint Protection 12.1 - Tamper-Protection Bypass

Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-6331-SYMANTEC-ENDPOINT-PROTECTION-TAMPER-PROTECTION-BYPASS.txt + ISR: ApparitionSec Vendor: ======= www.symantec.com Product: =========== Symantec Endpoint...

Symantec Endpoint Protection 12.1 - Tamper-Protection Bypass

Symantec Endpoint Protection 12.1 - Tamper-Protection Bypass + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-6331-SYMANTEC-ENDPOINT-PROTECTION-TAMPER-PROTECTION-BYPASS.txt + ISR: ApparitionSec Vendor: =======...

Pentesting Active Directory Environments: CrackMapExec

Pentesting Active Directory Environments: CrackMapExec CrackMapExec a.k.a CME is a post-exploitation tool that helps automate assessing the security of large Active Directory networks. Built with stealth in mind, CME follows the concept of “Living off the Land”: abusing built-in Active Directory...