SpoolFool

SpoolFool Exploit for CVE-2022-21999 - Windows Print Spooler Elevation of Privilege Vulnerability LPE Details The provided exploit should work by default on all Windows desktop versions. Please see the blog post for full technical details here. Usage PS C:\SpoolFool .\SpoolFool.exe SpoolFool By...

DLLHijackingScanner

UAC bypass - DLL hijacking Description This is a PoC for bypassing UAC using DLL hijacking and abusing the "Trusted Directories" verification. Summary Generate Header from CSV Arguments Generate the list of vulnerable PE and DLL DLLHijacking.exe Log file Execution Result test.dll Sources Generate...

EvtMute

EvtMute This is a tool that allows you to offensively use YARA to apply a filter to the events being reported by windows event logging. Usage Grap the latest verison from here. EvtMuteHook.dll contains the core functionality, once it is injected it will apply a temporary filter which will allow a...

PowerShx

SharpShx Unmanaged PowerShell execution using DLLs or a standalone executable. Introduction PowerShx is a rewrite and expansion on the PowerShdll project. PowerShx provide functionalities for bypassing AMSI and running PS Cmdlets. Features Run Powershell with DLLs using rundll32.exe,...

IDiagnosticProfileUAC

IDiagnosticProfileUAC Just another UAC bypass using auto-elevated COM object Virtual Factory for DiagCpl 12C21EA7-2EB8-4B55-9249-AC243DA8C666. This COM object can be used to create instance of DiagnosticProfile D0B7E02C-E1A3-11DC-81FF-001185AE5E76 COM object which exposes SaveDirectoryAsCab metho...

SharpSploitConsole

SharpSploitConsole Console Application designed to interact with SharpSploit released by @cobbrio https://github.com/cobbr/SharpSploit SharpSploit is a tool written by @cobbrio that combines many techniques/C code from the infosec community and combines it into one sweet DLL. It's awesome so chec...

VMInjector

V M I n j e c t o r c 2012 by Marco Batista Licensed under GPLv3 see LICENSE file Overview: VMInjector is a tool designed to bypass OS login authentication screens of major operating systems running on VMware Workstation/Player, by using direct memory manipulation. Description: VMInjector is a to...

SpoolSploit

SpoolSploit A collection of Windows print spooler exploits containerized with other utilities for practical exploitation. Summary SpoolSploit is a collection of Windows print spooler exploits containerized with other utilities for practical exploitation. A couple of highly effective methods would...

Remote-DLL-Injection-with-Timer-based-Shellcode-Execution

Remote DLL Injection with Timer-based Shellcode Execution Documentation updated from previous mistake proces injection title! ⚠ Educational Research Only This repository contains security research for educational purposes and authorized use only. Use responsibly and in accordance with all...

xori

Xori - Custom disassembly framework Xori is an automation-ready disassembly and static analysis library that consumes shellcode or PE binaries and provides triage analysis data. Acknowledgements: Xori wouldn't exist without inspiration and ideas from the open source community. We are indebted to...

CoercedPotatoRDLL

Coerced Potato Reflective DLL Privilege escalation from NT Service to SYSTEM using SeImpersonateToken privilege and MS-RPRN functions. Heavily based on https://github.com/Prepouce/CoercedPotato Reflective Loader from https://github.com/stephenfewer/ReflectiveDLLInjection. Install Clone this repo...

TrustJack

TrustJack Yet another PoC for https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows Blogpost: https://redteamer.tips/?p=108 To be used with a cmd that does whatever the F you want, for a dll that pops cmd, https://github.com/jfmaes/CMDLL. check the list in wietze's site to check how you...

Evasor

Overview The Evasor is an automated security assessment tool which locates existing executables on the Windows operating system that can be used to bypass any Application Control rules. It is very easy to use, quick, saves time and fully automated which generates for you a report including...

Cooolis-ms

Cooolis-ms Wiki Documentation Cooolis-ms is a code execution tool that includes a Metasploit Payload Loader, Cobalt Strike External C2 Loader, and Reflective DLL injection. It is designed to evade static detection of code we intend to execute that contains known signatures, helping red team...

obex

Obex - DLL Blocking Obex is a PoC tool/technique that can be used to prevent unwanted modules e.g., EDR or monitoring libraries from being loaded into a newly started process during process initialization or at runtime. Features Spawns any process with arguments under debug control. Blocks a...

EDR-Preloader

EDR-Preloader An EDR bypass that prevent EDRs from hooking or loading DLLs into our process by hijacking the AppVerifier layer For details, see: malwaretech.com/2024/02/bypassing-edrs-with-edr-preload.html...

DetectWindowsCopyOnWriteForAPI

Windows Process Property Enumeration Tools for Threat Hunting Background The purpose of these tools is to enumerate traits of Windows processes that support the detection of process injection tradecraft used by threat actors. Tools d-cow - Windows Copy on Write Detector for shared Windows APIs e....

iscsicpl_bypassUAC

iscsicpl autoelevate DLL Search Order hijacking UAC Bypass 0day The iscsicpl.exe binary is vulnerable to a DLL Search Order hijacking vulnerability when running 32bit Microsoft binary on a 64bit host via SysWOW64. The 32bit binary, will perform a search within user %Path% for the DLL iscsiexe.dll...

DropSpawn_BOF

DropSpawn Introduction DropSpawn is a CobaltStrike BOF used to spawn additional Beacons via a relatively unknown method of DLL hijacking. Works x86-x86, x64-x64, and x86-x64/vice versa. Use as an alternative to process injection. Windows executables will follow the DLL search order when trying to...

EDRs

EDRs This repo contains information about EDRs that can be useful during red team exercise. patchsyscalldynamically64.c This proof-of-concept is resolving the syscall ID dynamically no need to check the version running on the remote host. To get the information on disk not tampered a call to...