CPLDCOMTrigger

CPLDCOMTrigger Description A Python script depends on Impacket scripts to trigger the loading of a .cpl file into memory using a DCOM object. The CPL file path must already be added to the registry. The script uses the Open function in the IOpenControlPanel interface to load the CPL Control Panel...

VMInjector

V M I n j e c t o r root@kitploit: c 2012 by Marco Batista Licensed under GPLv3 see LICENSE file Overview: VMInjector is a tool designed to bypass OS login authentication screens of major operating systems running on VMware Workstation/Player, by using direct memory manipulation. Description:...

TotalRecall

TotalRecall Reloaded Breaking Windows Recall. Again. image When Microsoft redesigned Recall with VBS enclaves, AES-256-GCM encryption, Windows Hello authentication, and a Protected Process Light host, the message was clear: the data is locked in a vault. The vault is solid. The delivery truck is...

CVE-2022-27502

RealVNC server up to 6.9.0 DLL Hijacking Exploit CVE-2022-27502 You can use pre-compiled version 64-bit of it from HERE Copy it to %TEMP% and initiate a repair of RealVNC Server from add or remove programs. It will write the output of whoami command in %TEMP%\output.txt If you want to change the...

BumbleCrypt

BumbleCrypt A Bumblebee-inspired Crypter Background The BumbleCrypt is inspired by Bumblebee's crypter, in Bumblebee's case the main Bumblebee DLL is been loaded in the memory and executed in the following way: Decrypts and writes the payload in the Heap Hooks three NtApi's - NtOpenFile,...

NimDllSideload

Nim DLL Sideloading This repo allows you to easily generate Nim DLLs you can use sideloading/proxy loading. If you're unfamiliar with what DLL sideloading is, take a gander at this blog post. How do I use this? Put the legit DLL or multiple DLLs you want to proxy into the build directory of this...

venom-rs

Shellcode Reflective DLL Injection sRDI in Rust Codename: Venom Shellcode reflective DLL injection sRDI is a process injection technique that allows us to convert a given DLL into a position-independent code which can then be injected using our favourite shellcode injection and execution techniqu...

Nidhogg

Nidhogg Nidhogg es un rootkit multifuncional para mostrar la variedad de operaciones que se pueden realizar desde el espacio del kernel. El objetivo de Nidhogg es proporcionar un rootkit todo en uno y fácil de usar con múltiples funcionalidades útiles para operaciones. Además, también se puede...

DuplexSpyCS

DuplexSpy DuplexSpyCS CS stands for CSharp is a open source RAT base on C/S Continuously update: Branch-Version2.1.0 Documents The online documents are here: DuplexSpy Fileless Execution DLL and shellcode injector and loader Remote Plugin Proxy Introduction DuplexSpy is a open-source Windows RAT...

Shellcode-Test-Harness

Herramienta de Prueba de Shellcode Un entorno de prueba ligero diseñado para acelerar el desarrollo de shellcode, proporcionando un entorno de ejecución con diagnóstico de fallos integrado y redirección de salida de depuración. Características Ejecuta shellcode mediante module stomping Usa VEH pa...

EvtMute

EvtMute Esta es una herramienta que te permite usar YARA de manera ofensiva para aplicar un filtro sobre los eventos que reporta el registro de eventos de Windows. Uso Obtén la última versión desde aquí. EvtMuteHook.dll contiene la funcionalidad principal; una vez inyectado, aplicará un filtro...

ExportHider

ExportHider ExportHider generates a C++ DLL template which contains a code stub that allows you to hide Exported Functions from the Export Directory of the DLL on the filesystem. After putting the function definitions and compiling the file, you won't see the hidden export functions through PE Fi...

obex

Obex - DLL Blocking Obex is a PoC tool/technique that can be used to prevent unwanted modules e.g., EDR or monitoring libraries from being loaded into a newly started process during process initialization or at runtime. Features Spawns any process with arguments under debug control. Blocks a...

CVE-2021-1675

CVE-2021-1675 / CVE-2021-34527 Implementación de Impacket del PoC de PrintNightmare creado originalmente por Zhiniang Peng @edwardzpeng y Xuefeng Li @lxf02942370 Probado en un Controlador de Dominio 2019 completamente parcheado Ejecutar DLL maliciosas de forma remota o local Actualización de parc...

koppeling-p

...

cve-2021-34527

CVE-2021-34527 CVE-2021-34527 LPE exploit using AddPrinterDriverEx - this is a weaponized version of the LPE that can be used to escalate a DLL to SYSTEM and will also clean up artifacts. The LPE impacts Windows Desktop 7,8,8.1,10,11 & Server 2008,2012,2016,2019. This visual studio project will...

BeatRev

BeatRev Versión 2 Descargo de responsabilidad / Responsabilidad El trabajo que sigue es un POC para permitir que el malware se "vincule" a una víctima particular con el fin de frustrar los esfuerzos de los analistas de malware. No asumo ninguna responsabilidad por el uso malicioso de cualquier id...

CVE-2020-24972

So CVE-2020-24972 spans from another cve in actually. I don't remember the cve that got designated but it has to do with platformpluginpath cmdline option from qt. So in essence the problem comes from using qt, persee the option platformpluginpath . "This parameter is supposed to contain a...

makin

I create makin to make initial malware assessment little bit easier for me, I think it's useful for others as well, It helps to reveal a debugger detection techniques used by a sample. Cualquier comentario es muy apreciado: @qazqaz ¿Cómo funciona? makin abre una muestra como depurado e inyecta...

CompMgmtLauncher_DLL_UACBypass

CompMgmtLauncher & Sharepoint DLL Search Order hijacking UAC/persist via OneDrive CompMgmtLauncher.exe is vulnerable to to a DLL Search Order hijacking vulnerability. The binary, will perform a search within user env for the DLL's Secur32.dll or Wininet.dll when Onedrive is installed...