DuplicateDump

DuplicateDump DuplicateDump — это форк MirrorDump со следующими изменениями: Реализация DInovke LSA-плагин DLL, написанный на C++, который можно очистить после дампа LSASS. MirrorDump компилирует LSA-плагин как сборку .NET, которая не может быть выгружена процессом LSASS. Вот почему MirrorDump не...

Nim_DInvoke

Nim DInvoke Реализация D/Invoke на Nim Все Nim-бинары обычно экспортируют одни и те же 58–60 функций Windows API: Все остальные функции Windows API обычно разрешаются во время выполнения через GetProcAddress и LoadLibraryA, как упоминается в OffensiveNim или этой записи в блоге. Таким образом,...

DInvoke

DInvoke Sostituto dinamico di PInvoke su Windows. DInvoke contiene potenti primitive che possono essere combinate in modo intelligente per richiamare dinamicamente codice non gestito dal disco o dalla memoria con precisione. Può essere utilizzato per molti scopi come il parsing di PE, la...

nimvoke

nimvoke Syscall indiretti + DInvoke resi semplici. Progettato per essere importato direttamente nei tuoi progetti Nim, nimvoke usa macro per astrarre i dettagli delle chiamate di sistema indirette e delle dichiarazioni di delegati in stile DInvoke. Questa libreria è pensata per essere facile da...

Fiber - Using Fibers To Run In-Memory Code In A Different And Stealthy Way

A fiber is a unit of execution that must be manually scheduled by the application rather than rely on the priority-based scheduling mechanism built into Windows. Fibers are often called lightweight threads. For more detailed information about what are and how fibers work consult the official...

DuplicateDump - Dumping LSASS With A Duplicated Handle From Custom LSA Plugin

DuplicateDump is a fork of MirrorDump with following modifications: DInovke implementation LSA plugin DLL written in C++ which could be clean up after dumping LSASS. MirrorDump compile LSA plugin as .NET assembly which would not be unloaded by LSASS process. That's why MirrorDump failed to delete...

DInjector - Collection Of Shellcode Injection Techniques Packed In A D/Invoke Weaponized DLL

This repository is an accumulation of my code snippets for various shellcode injection techniques using fantastic D/Invoke API by @TheWover and @FuzzySecurity. Features: Fully ported to D/Invoke API Encrypted payloads which can be invoked from a URL or passed in base64 as an argument Built-in AMS...

LOLBITS v2.0.0 - C2 Framework That Uses Background Intelligent Transfer Service (BITS) As Communication Protocol And Direct Syscalls + Dinvoke For EDR User-Mode Hooking Evasion

LOLBITS is a C2 framework that uses Microsoft's Background Intelligent Transfer Service BITS to establish the communication channel between the compromised host and the backend. The C2 backend is hidden behind an apparently harmless flask web application and it's only accesible when the HTTP...