Lucene search
+L

8 matches found

Kitploit
Kitploit
added 2026/09/15 2:57 a.m.7 views

NimicStack

NimicStack NimicStack es la implementación pura en Nim de la técnica de Call Stack Spoofing para imitar programas legítimos. Todo el proyecto se basa en la PoC compartida por WithSecure Labs Compilación Puedes compilar directamente el código fuente con el siguiente comando: nim c -d=mingw...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/15 2:36 a.m.65 views

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

5.9AI score
SaveExploits0References14
Kitploit
Kitploit
added 2026/09/14 7:00 p.m.7 views

LazyHook

Overview LazyHook is a stealthy API hooking framework that bypasses Host Intrusion Prevention Systems HIPS through call stack spoofing. By leveraging CPU-level hardware breakpoints and Vectored Exception Handling, it executes arbitrary code as if it originated from trusted, Microsoft-signed...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/14 8:49 a.m.11 views

Shelter

Shelter Shelter is a completely weaponized sleep obfuscation technique that allows to fully encrypt your in-memory payload making an extensive use of ROP. This crate comes with the following characteristics: AES-128 encryption. Whole PE encryption capability. Removal of execution permission durin...

6AI score
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/12 6:20 a.m.9 views

CallStackSpoofer

CallStackSpoofer Este repositorio demuestra una implementación de PoC para suplantar pilas de llamadas arbitrarias al realizar llamadas al sistema. Para una guía técnica completa, consulta la entrada de blog que acompaña a este repositorio aquí:...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/12 5:49 a.m.7 views

Unwinder

Contenido SilentMoonWalk Descripción Créditos Uso Macro callfunction! Macro indirectsyscall! Paso de parámetros Ejemplos Llamando a kernel32.dll!Sleep Llamando a kernel32.dll!OpenProcess Llamando a NtDelayExecution como syscall indirecto Concatenar llamadas a macros Consideraciones Frame inicial...

5.9AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/11 10:23 p.m.9 views

CallStackMasker

CallStackMasker Este repositorio demuestra una técnica de prueba de concepto PoC para suplantar dinámicamente pilas de llamadas mediante temporizadores. Antes de que nuestro implante entre en suspensión, podemos poner en cola temporizadores para sobrescribir su pila de llamadas con una falsa y...

5.9AI score
SaveExploits0
The Hacker News
The Hacker News
added 2025/04/02 5:55 a.m.23 views

New Malware Loaders Use Call Stack Spoofing, GitHub C2, and .NET Reactor for Stealth

Cybersecurity researchers have discovered an updated version of a malware loader called Hijack Loader that implements new features to evade detection and establish persistence on compromised systems. "Hijack Loader released a new module that implements call stack spoofing to hide the origin of...

8.3AI score
SaveExploits0
Rows per page
Query Builder