pe-bear

PE-bear PE-bear is a multiplatform reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files. Signatures for PE-bear: SIG.txt updated: Oct 17, 2022 - contains signatures fromPEid's UserDB -...

Windows x64 Meterpreter/Stage Reverse TCP Stager

x64 reverse TCP stager: connect, read 4-byte LE size + stage, VirtualAlloc RWX and jump. Use with a stage pusher or pair stagemode=shell for embedded cmd.exe stage. Listener: listeners/multi/meterpreterreversetcp or reversetcp for shell mode. from kittysploit import import base64 import struct...

Windows Defender Evasive JS.Net and HTA

Generate an HTA that writes and compiles a JScript.NET file containing shellcode on the target machine. The compiled EXE executes the payload via dynamic P/Invoke VirtualAlloc/CreateThread. RC4 or HTTPS payloads are recommended for best results against Defender. !/usr/bin/env python3 -- coding:...

Encrypted Shellcode Dropper Evasion

Generate a Windows x64 EXE that decrypts embedded shellcode in memory and executes it via VirtualAlloc/VirtualProtect/CreateThread. Uses ChaCha20 or RC4 encryption with optional pre-execution sleep. !/usr/bin/env python3 -- coding: utf-8 -- """ Encrypted shellcode dropper Win32 API. Minimal Windo...

charlotte

This is a C++ shellcode launcher, fully undetected as of May 13th, 2021. It dynamically invokes Windows API functions, XOR encrypts shellcode and function names, and uses random XOR keys and variables per run. The code is designed to be stealthy and evade detection. The code is written in C++ and...

Jektor - A Windows User-Mode Shellcode Execution Tool That Demonstrates Various Techniques That Malware Uses

This utility focuses on shellcode injection techniques to demonstrate methods that malware may use to execute shellcode on a victim system Dynamically resolves API functions to evade IAT inclusion Includes usage of undocumented NT Windows API functions Supports local shellcode execution via...

cThreadHijack - Beacon Object File (BOF) For Remote Process Injection Via Thread Hijacking

. . . \ /| | | / | || || | | / | | | | \ / \ \ / / \ | | \ \ / | |/ / \ | | | Y \ | /\ / / / // \ Y / | | |/ \ | | || /| \ /\ || /|/| /\ | \ / / / / / / | / / / Beacon Object File BOF for remote process injection, via thread hijacking, without spawning a remote thread...

Staying Hidden on the Endpoint: Evading Detection with Shellcode

True red team assessments require a secondary objective of avoiding detection. Part of the glory of a successful red team assessment is not getting detected by anything or anyone on the system. As modern Endpoint Detection and Response EDR products have matured over the years, the red teams must...