inject-assembly

inject-assembly - Execute .NET in an Existing Process This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon,...

frostbyte

FrostByte Progolue: In the past few days I've been experimenting with the AppDomain manager injection technique had a decent success with it in my previous Red Team engagements against certain EDRs. Although, this is really good for initial access vector, I wanted to release a POC which will help...

frostbyte

FrostByte 프롤로그: 지난 며칠 동안 AppDomain Manager injection 기법을 실험해보았고, 이전 Red Team 활동에서 특정 EDR을 상대로 꽤 성공적이었습니다. 이 방법은 초기 접근 벡터로 아주 좋지만, 셸코드를 다른 곳에 숨길 수 있는 POC를 공개하고 싶었습니다. 더 이상 셸코드가 포함된 DLL 파일은 없습니다! 문제점! 이 기법은 단독으로 사용할 때는 훌륭하지만, ISO/ZIP/VHD/VHDX 파일 안에 C ClickOnce를 전송하는 전달 기법과 결합될 때 문제가 발생합니다. 실제 문제는 1...

clrinject

clrinject 任意のCLRランタイムおよび別プロセスのAppDomainにC EXEまたはDLLアセンブリを注入します。注入されたアセンブリは、注入先プロセスのクラスの静的インスタンスにアクセスできるため、その内部状態に影響を与えることができます。 使用方法 clrinject-cli.exe -p -a ID または名前 のプロセスを開き、 EXEを注入してMainメソッドを実行します。 追加オプション -e 読み込まれているすべてのCLRランタイムと作成されたAppDomainを列挙します。 -d...

APT41-Linked Silver Dragon Targets Governments Using Cobalt Strike and Google Drive C2

Cybersecurity researchers have disclosed details of an advanced persistent threat APT group dubbed Silver Dragon that has been linked to cyber attacks targeting entities in Europe and Southeast Asia since at least mid-2024. "Silver Dragon gains its initial access by exploiting public-facing...

Exploit for Incorrect Comparison in Dynamic-Linq Linq

Dynamic Linq injection to RCE - CVE-2023-32571 About Dynami...

Donut - Generates X86, X64, Or AMD64+x86 Position-Independent Shellcode That Loads .NET Assemblies, PE Files, And Other Windows Payloads From Memory

Donut generates x86 or x64 shellcode from VBScript, JScript, EXE, DLL including .NET Assemblies files. This shellcode can be injected into an arbitrary Windows processes for in-memory execution. Given a supported file type, parameters and an entry point where applicable such as Program.Main, it...