Detours

Microsoft Research Detours Package Detours is a software package for monitoring and instrumenting API calls on Windows. Detours has been used by many ISVs and is also used by product teams at Microsoft. Detours is now available under a standard open source license MIT. This simplifies licensing f...

RDPCredentialStealer

RDPCredentialStealer RDPCredentialStealer es un implante que roba credenciales proporcionadas por los usuarios en RDP mediante API Hooking con Detours en C++ Herramienta de Prueba de Concepto para el Robo de Credenciales Probemos esto: Primero, transfiero la DLL del repositorio de GitHub a la rut...

NoArgs

NoArgs: Manipulating and Hiding Process Arguments Twitter: @AzizWho Disclaimer: Educational Use Only This tool is intended solely for educational purposes. I am not liable for any misuse and all users must adhere to applicable laws. Illegal use is prohibited. Introduction NoArgs is a tool designe...

aDLL

aDLL - Aventura de la Biblioteca de Enlace Dinámico aDLL es una herramienta de análisis binario centrada en el descubrimiento automático de vulnerabilidades de DLL Hijacking. La herramienta analiza la imagen del binario cargada en memoria para buscar DLLs cargadas en tiempo de carga y hace uso de...

HookTools

HookTools Overview HookTools is a small tool designed to aid in the analysis of extremely evasive malware. It can be injected into a piece of malware to determine its reaction to specific changes. Features HookTools comes with a series of toggleable features: Module Name Access : Allow the analyz...

NoArgs - Tool Designed To Dynamically Spoof And Conceal Process Arguments While Staying Undetected

NoArgs is a tool designed to dynamically spoof and conceal process arguments while staying undetected. It achieves this by hooking into Windows APIs to dynamically manipulate the Windows internals on the go. This allows NoArgs to alter process arguments discreetly. Default Cmd: Windows Event Logs...

DLLHSC - DLL Hijack SCanner A Tool To Assist With The Discovery Of Suitable Candidates For DLL Hijacking

DLL Hijack SCanner - A tool to generate leads and automate the discovery of candidates for DLL Search Order Hijacking Contents of this repository This repository hosts the Visual Studio project file for the tool DLLHSC, the project file for the API hooking functionality detour, the project file f...

Remote Symbol Resolution

Introduction The following blog discusses a couple of common techniques that malware uses to obscure its access to the Windows API. In both forms examined, analysts must calculate the API start address and resolve the symbol from the runtime process in order to determine functionality. After...

Remote Symbol Resolution

Introduction The following blog discusses a couple of common techniques that malware uses to obscure its access to the Windows API. In both forms examined, analysts must calculate the API start address and resolve the symbol from the runtime process in order to determine functionality. After...

Microsoft Fixes 47 Vulnerabilities with September Patch Tuesday

Microsoft patched 47 vulnerabilities as part of 14 security bulletins, seven critical, with its monthly Patch Tuesday updates today. The company is warning users that if left unpatched, 10 of the issues can lead to remote execution. The updates resolve issues in Microsoft Windows, Office, Office...

Detours to modify the paragraph properties of vulnerability-vulnerability warning-the black bar safety net

Detours to modify the paragraph properties of the vulnerability Affected Software and systems Detours3. 0 and previous versions Description This issue will be its positioning as a vulnerability may be less suitable, the more likely that Detours a BUG, but because the defect will cause the exploit...

Detours information leak vulnerability-vulnerability warning-the black bar safety net

Detours information leak vulnerability Affected Software and systems Detours3. 0 and previous versions Description With the vulnerability related to the earliest description found in tk, the leader found the“Microsoft EMET destruction of the system The ASLR security mechanism of Vulnerability”in...

Quake 3 Engine Client - CG_ServerCommand() Remote Overflow

Quake 3 Engine Client - CGServerCommand Remote Overflow / Quake 3 Engine Client CGServerCommand Remote Stack Overflow Exploit Win32 Written by RunningBon E-Mail: [email protected] IRC: irc.rizon.net kik This is a DLL, which gets injected into the server exe. You will need Microsoft Detours...

Quake 3 Engine Client (Windows x86) - CS_ITEms Remote Overflow

/ Quake 3 Engine Client CSITEMS Remote Stack Overflow Exploit Win32 Written by RunningBon E-Mail: [email protected] IRC: irc.rizon.net kik This is a DLL, which gets injected into the server exe. You will need Microsoft Detours library to compile this exploit...

Quake 3 Engine Client CS_ITEMS Remote Overflow Exploit (Win32)

Exploit for unknown platform in category dos / poc ============================================================== Quake 3 Engine Client CSITEMS Remote Overflow Exploit Win32 ============================================================== / Quake 3 Engine Client CSITEMS Remote Stack Overflow Exploi...

Quake 3 Engine Client - 'CG_ServerCommand()' Remote Overflow

/ Quake 3 Engine Client CGServerCommand Remote Stack Overflow Exploit Win32 Written by RunningBon E-Mail: [email protected] IRC: irc.rizon.net kik This is a DLL, which gets injected into the server exe. You will need Microsoft Detours library to compile this exploit...

Quake 3 Engine Client CG_ServerCommand() Remote Overflow Exploit

Exploit for unknown platform in category dos / poc ================================================================ Quake 3 Engine Client CGServerCommand Remote Overflow Exploit ================================================================ / Quake 3 Engine Client CGServerCommand Remote Stack...

Quake 3 Engine Client (Windows x86) - CS_ITEms Remote Overflow

Quake 3 Engine Client Windows x86 - CSITEms Remote Overflow / Quake 3 Engine Client CSITEMS Remote Stack Overflow Exploit Win32 Written by RunningBon E-Mail: [email protected] IRC: irc.rizon.net kik This is a DLL, which gets injected into the server exe. You will need Microsoft Detours library...

microsoft.autoroute.express.2000.txt

Date: Tue, 11 May 1999 12:25:21 +0100 BST From: Pete Mellor Subject: MS AutoRoute Express 2000 The following is taken from the BBC Watchdog web pages www.bbc.co.uk/watchdog. I would like to thank Gordon Brown for passing it to one of my colleagues. AutoRoute Express 2000 Weekend Watchdog 07.05.99...