228 matches found
PE-Obfuscator
PE-Obfuscator Obfuscator di PE progettato con l'Evasion in mente, richiede privilegi di amministratore per caricare il driver RTCore64. Video: https://user-images.githubusercontent.com/123980007/234171901-c1eb735e-ceca-481d-9310-02ba30f6836b.mp4 L'Obfuscator : root@kitploit: - Ottiene un PE...
EDRUnChoker
EDRUnChoker Rimedio WMI senza file perEDRChoker contrasta l'abuso QoS pacer.sys che limita la larghezza di banda di rete degli agenti EDR a quasi zero. Registra una sottoscrizione permanente in root\subscription nessun file su disco. Un timer di 5 secondi esegue un VBScript incorporato che enumer...
teams-cookies-bof
teams-cookies-bof Stehlen Sie Cookies für Teams, während Sie im ms-teams.exe-Prozess laufen. Verwandter Beitrag: https://tierzerosecurity.co.nz/2025/11/03/teams-cookies-bof.html Basiert auf: https://blog.randorisec.fr/ms-teams-access-tokens/. Dieses Tool basiert stark auf dem Cookie-Monster-BOF...
ICMP-Ghost-A-Fileless-x64-Assembly-C2-Agent
root@kitploit: |\ |\ |\ |\ |\ |\ \ |\ |\ \ \ \ | \ \ \\ \ \ |\ \ \ || \ | \ \ |||\ \ \ \ \ \ \ \ \ \\ \ \ \ \ \ \ \ \ \ \ \ \ \ |\ \ \ \ \ \ \ \ \\ ||\ \ \ \ \ \ \ |\ \ \ \ \ \ \ \\ \ \ \ \ \\ ||||||||\ || ||| || Dateiloser, reiner x64-Assembly-C2-Implantat, der...
DuplexSpyCS
DuplexSpy DuplexSpyCS CS sta per CSharp è un RAT open source basato su C/S Aggiornamento continuo: Branch-Version2.1.0 Documenti I documenti online sono qui: DuplexSpy Esecuzione Fileless Iniettore e caricatore di DLL e shellcode Plugin Remoto Proxy Introduzione DuplexSpy è un RAT Windows...
DCOMIllusionist
🎩✨🪄 DCOMIllusionist Windows-Technik für dateilose laterale Bewegung. Einleitung • Build • Verwendung • Technische Details • Danksagungen Einleitung Dieses Tool ermöglicht die Remote-Codeausführung auf einem Windows-Rechner, sofern Sie über administrative Rechte verfügen. Es nutzt DCOM und das...
NimExec
NimExec In pratica, NimExec è uno strumento di esecuzione di comandi remoti senza file che utilizza il protocollo remoto di Service Control Manager MS-SCMR. Modifica il percorso binario di un servizio random o specificato eseguito da LocalSystem per eseguire il comando fornito sul target e lo...
punk.py
punk.py unix SSH post-exploitation 1337 tool how it works punk.py is a post-exploitation tool meant to help network pivoting from a compromised unix box. It collect usernames, ssh keys and known hosts from a unix system, then it tries to connect via ssh to all the combinations found. punk.py is...
cuddlephish
CuddlePhish Weaponized multi-user browser-in-the-middle BitM for penetration testers. This attack can be used to bypass multi-factor authentication on many high-value web applications. It even works for applications that do not use session tokens, and therefore would not be exploitable using...
fileless-xec
➲ fileless-xec 🦜 👋 Certainly useful , mainly for fun, rougly inspired by 0x00 article Pentest use: fileless-xec is used on target machine to stealthy execute a binary file located on attacker machine ➲ Short story fileless-xec enable us to execute a remote binary on a local machine directly from...
Copy-Fail-CVE-2026-31431-Lab
Copy Fail CVE-2026-31431 — Laboratório de Reprodução e Detecção de Exploit Este repositório documenta a reprodução de ponta a ponta, a engenharia de detecção e a resposta a incidentes para CVE-2026-31431 "Copy Fail" , uma vulnerabilidade crítica de escalonamento de privilégios local no kernel Lin...
tracee
Before moving on, please consider giving us a GitHub star ⭐️. Thank you! About Tracee Tracee is a runtime security and observability tool that helps you understand how your system and applications behave. It is using eBPF technology to tap into your system and expose that information as events tha...
-Remcos-RAT-Fileless-svchost-Injection-Obfuscated-Payload-Analysis-
1. Remcos – Iniezione in svchost tramite chiamate API Native Il seguente frammento di Binary Ninja rivela il meccanismo di iniezione principale utilizzato da Remcos per iniettare il suo payload in svchost.exe. Cosa fa questo codice: CreateProcessW con il flag CREATESUSPENDED avvia un nuovo...
BitLock-Crypto-Research
🛡️ BitLock Framework: Ecosistema di Crittovirologia e C2 PoC Questo repository contiene una Proof of Concept PoC completa progettata per lo studio delle architetture di minacce moderne. Il progetto simula un ambiente di attacco fileless senza file con un'infrastruttura di comando e controllo C2...
FilelessPELoader
FilelessPELoader Carica un PE remoto crittografato AES in memoria, lo decritta e lo esegue Utilizzo : Riferimenti : https://github.com/aplyc1a/PEMemoryLoader?fbclid=IwAR2-VAQo8pJU-tdbSENjhDBdDGi5tyzrnW1S3D9BPAYR6C6-RK4hsEDjDGk Requisiti 1. hashlib 2. pycryptodome 3. pycryptodomex...
Copy-Fail-CVE-2026-31431-Lab — Updated!
Copy Fail CVE-2026-31431 — Exploit Reproduction & Detection Lab This repository documents the end-to-end reproduction, detection engineering, and incident response for CVE-2026-31431 "Copy Fail" , a critical Linux kernel local privilege escalation vulnerability affecting kernels 4.14 through...
Malicious code in jsonschema-viewer (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3692022b4caf5ac51d868aaae58e793520ac3bd36703841eb615942baf85bb87 The package's only function — main in src/jsonschemaviewer/main.py, registered as the jsonschema-viewer console script — invokes os.system to fetch a...
MAL-2026-6248 Malicious code in jsonschema-viewer (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3692022b4caf5ac51d868aaae58e793520ac3bd36703841eb615942baf85bb87 The package's only function — main in src/jsonschemaviewer/main.py, registered as the jsonschema-viewer console script — invokes os.system to fetch a...
Fake Purchase Order Emails Spread Fileless PureLogs Malware via RAR Archives
Hackers are using fake purchase order emails and process hollowing to deploy fileless PureLogs malware to steal Windows users' browser, crypto, and Discord data...