PatchlessCLRLoader

PatchlessCLRLoader PatchlessCLRLoader 是 InlineExecute-Assembly 的一个分支，用于加载 .NET 程序集并将输出定向到 mailslot。我将其重写为独立加载器，实现如下： AES 加密载荷 支持无文件载荷 使用硬件断点实现无补丁 AMSI 和 ETW 绕过 备注：目前加载器仅支持在主线程中设置 HWBP。 与传统的修补技术相比，使用硬件断点进行无补丁绕过具有多个优势。首先，它避免了使用 NtProtectVirtualMemory 等广为人知的 API，这些 API...

Exploit kits: fall 2018 review

Exploit kit EK activity continues to surprise us as the weather cools, the leaves change, and we move into the fall of 2018. Indeed, shortly after our summer review, a new exploit kit was discovered, and while no new vulnerabilities were added to the current EKs, several malvertising chains are...