611 matches found
dll-injector
About As the name suggests, the application primarily performs injecting a DLL into any process running on Windows. With the power of this, it is able to perform several operations on a process such as loading a DLL, unloading a DLL, and hooking primary WinAPI functions e.g., CreateFileW, ReadFil...
TotalRecall
TotalRecall Reloaded Breaking Windows Recall. Again. image When Microsoft redesigned Recall with VBS enclaves, AES-256-GCM encryption, Windows Hello authentication, and a Protected Process Light host, the message was clear: the data is locked in a vault. The vault is solid. The delivery truck is...
CobaltStrikeScan
CobaltStrikeScan Scan files or process memory for Cobalt Strike beacons and parse their configuration. CobaltStrikeScan scans Windows process memory for evidence of DLL injection classic or reflective injection and/or performs a YARA scan on the target process' memory for Cobalt Strike v3 and v4...
CVE-2010-5301
CVE-2010-5301 A proof of concept of an SEH overflow with arbitrary dll injection Description Kolibrì HTTP Server 2.0 is affected by a stack-based buffer overflow. At the time of discovery this vulnerability was exploited by simply overwriting the instruction pointer with a JMP ESP instruction,...
staged-DLL-Injection-SMB-
staged-DLL-Injection Staged DLL injection proof-of-concept built in C using Win32 APIs — developed in an isolated lab environment for red team certification study CRTO. ⚠️ Disclaimer: This project was developed strictly in an isolated lab environment for educational purposes as part of offensive...
DuplexSpyCS
DuplexSpy DuplexSpyCS CS stands for CSharp is a open source RAT base on C/S Continuously update: Branch-Version2.1.0 Documents The online documents are here: DuplexSpy Fileless Execution DLL and shellcode injector and loader Remote Plugin Proxy Introduction DuplexSpy is a open-source Windows RAT...
memhunter
Memhunter Automated hunting of memory resident malware at scale This project is WORK IN PROGRESS. Expect feature changes and binary releases on the upcoming weeks. Overview Memhunter is an endpoint sensor tool that is specialized in detecing resident malware, improving the threat hunter analysis...
zirconium
zirconium DLL-injectable game cheat for Call of Duty: Black Ops 2 Zombies with the Plutonium mod. Downloads are in the Releases page Disclaimer: This project exists because I grew up on BO2, and it also happened to be a good target for reversing. It's a 14 year old AAA game thats practically dead...
InjectProc
InjectProc Process injection is a very popular method to hide malicious behavior of code and are heavily used by malware authors. There are several techniques, which are commonly used: DLL injection, process replacement a.k.a process hollowing, hook injection and APC injection. Most of them use...
hollows_hunter
hollowshunter Hollows Hunter is a command-line application based on PE-sieve passive memory scanner. Recognizes and dumps a variety of potentially malicious implants replaced/implanted PEs, shellcodes, hooks, in-memory patches. While in case of PE-sieve you can select the process only by its PID,...
DLL_Injection_On_VLC
DLL Injection and CVE-2010-3124 Overview 🌱 This project explores the topic of DLL Dynamic Link Library injection and specifically focuses on the CVE-2010-3124. CVE-2010-3124 refers to an untrusted search path vulnerability found in VLC Media Player version 1.1.3 and earlier. Here are key points...
Prineo_RE
About PriPara internal name Prineo is an arcade rythm game developed by SynSophia. Goal The goal of this project was to reverse the model format of the arcade series in order to port exclusive characters to the newer version of game on Nintendo Switch. Screenshots Some interesting screenshots tak...
Nidhogg
Nidhogg Nidhogg is a multi-functional rootkit to showcase the variety of operations that can be done from kernel space. The goal of Nidhogg is to provide an all-in-one and easy-to-use rootkit with multiple helpful functionalities for operations. Besides that, it can also easily be integrated with...
sRDI
sRDI - Shellcode Reflective DLL Injection sRDI allows for the conversion of DLL files to position independent shellcode. It attempts to be a fully functional PE loader supporting proper section permissions, TLS callbacks, and sanity checks. It can be thought of as a shellcode PE loader strapped t...
DragonCastle
DragonCastle A PoC that combines AutodialDLL lateral movement technique and SSP to scrape NTLM hashes from LSASS process. Description Upload a DLL to the target machine. Then it enables remote registry to modify AutodialDLL entry and start/restart BITS service. Svchosts would load our DLL, set...
EvtMute
EvtMute This is a tool that allows you to offensively use YARA to apply a filter to the events being reported by windows event logging. Usage Grap the latest verison from here. EvtMuteHook.dll contains the core functionality, once it is injected it will apply a temporary filter which will allow a...
VMInjector
V M I n j e c t o r root@kitploit: c 2012 by Marco Batista Licensed under GPLv3 see LICENSE file Overview: VMInjector is a tool designed to bypass OS login authentication screens of major operating systems running on VMware Workstation/Player, by using direct memory manipulation. Description:...
Cooolis-ms
Cooolis-ms Wiki Documentation Cooolis-ms is a code execution tool that includes a Metasploit Payload Loader, Cobalt Strike External C2 Loader, and Reflective DLL injection. It is designed to evade static detection of code we intend to execute that contains known signatures, helping red team...
Evasor
Overview The Evasor is an automated security assessment tool which locates existing executables on the Windows operating system that can be used to bypass any Application Control rules. It is very easy to use, quick, saves time and fully automated which generates for you a report including...