link

link link is a command and control framework written in rust. Currently in beta. Table of Contents Introduction Features Feedback Build Process Acknowledgments Introduction...

reconerator

अवलोकन यह एक कस्टम .NET असेंबली है जो कई स्थितिजन्य जागरूकता situational awareness गतिविधियाँ करती है। वर्तमान में कई फीचरसेट featuresets हैं: BASIC - डिस्क और रजिस्ट्री से जानकारी प्राप्त करता है। LDAP - अनुकूलित AD LDAP क्वेरी करने की अनुमति देता है। RESOLVEHOST - DNS लुकअप क्वेरी करता है।...

reconerator

Overview This is a custom .NET assembly which will perform a number of situational awareness activities. There are a number of current featuresets: BASIC - Obtains information from the disk and registry. LDAP - Allows customised AD LDAP queries to be made. RESOLVEHOST - Performs DNS lookup querie...

DNCI

DNCI - Dot Net Code Injector DNCI allows the injection of .Net code .exe or .dll remotely in unmanaged processes in windows. 1. Project Structure The project is structured in: DNCI.Injector.Library - Injection library. Contains all injection components and logic; DNCI.Injector.Runner - Command...

InlineExecute-Assembly

InlineExecute-Assembly InlineExecute-Assembly is a proof of concept Beacon Object File BOF that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module. InlineExecute-Assembly will execute any...

aether

Aether संस्करण : 0.9 स्थिर रिलीज़ Aether एक विंडोज मेमोरी-फोरेंसिक और खतरा-शिकार उपकरण है जो लाइव प्रक्रिया मेमोरी को स्कैन करता है दुर्भावनापूर्ण पैटर्न, इंजेक्शन तकनीक, इम्प्लांट सिग्नेचर, रिफ्लेक्टिवली लोडेड .NET असेंबली का पता लगाने के लिए। यह एक बहु-परत विश्वास मॉडल के साथ काम करता है जो झूठ...

dllspy

DllSpy Scans compiled .NET assemblies to discover input surfaces HTTP endpoints, SignalR hubs, WCF services, gRPC services, Razor Pages, Blazor components, Azure Functions, OData endpoints, check authorization configuration, and flag security issues — all without running the application. Availabl...

vba2clr

TLDR: Просто экспериментирую с различными способами загрузки CLR .NET сборок в VBA локально и удалённо с помощью AppDomain.ExecuteAssembly или любого другого удобного метода после обхода AccessVBOM программный доступ к проекту Visual Basic не является доверенным из VBA. vba2clr..vba: Устанавливае...

ExecuteAssembly

Description: ExecuteAssembly is an alternative of CS execute-assembly, built with C/C++ and it can be used to Load/Inject .NET assemblies by; reusing the host spawnto process loaded CLR Modules/AppDomainManager, Stomping Loader/.NET assembly PE DOS headers, Unlinking .NET related modules, bypassi...

LACheck

LACheck Multithreaded C .NET Assembly Local Administrative Privilege Enumeration Arguments root@kitploit: ./LACheck.exe help | | /\ / | | | | | | / \ | | | | | | | | / /\ \ | | | ' \ / / | |/ / | | / \ | || | | | / | |// \ || |||||\ Usage: LACheck.exe smb rpc...

inject-assembly

inject-assembly - किसी मौजूदा प्रक्रिया में .NET निष्पादित करें यह टूल Cobalt Strike के लिए पारंपरिक fork and run निष्पादन का एक विकल्प है। लोडर को किसी भी प्रक्रिया में इंजेक्ट किया जा सकता है, जिसमें वर्तमान Beacon भी शामिल है। लंबे समय तक चलने वाली असेंबली चलती रहेंगी और Beacon को आउटपुट वापस...

Invoke-noPac

Invoke-noPac यह .Net असेंबली मेरे फोर्क https://github.com/ricardojba/noPac पर आधारित है, जिसमें मूल कोड को बेहतर बनाने के लिए कुछ कोड परिवर्तन किए गए हैं। PowerSharpPack शैली का .Net असेंबली लोडर CVE-2021-42287 - CVE-2021-42278 स्कैनर और एक्सप्लॉइट noPac के लिए। उपयोग: root@kitploit:...

VMUnprotect.Dumper

VMUnprotect.Dumper VMUnprotect.Dumper est un projet dédié à la traque des assemblys VMProtect modifiés. Il utilise AsmResolver pour dépaqueter dynamiquement les assemblys protégés par VMP. Fonctionne avec VMProtect 3.7.0 dernière version et quelques versions antérieures. Avant utilisation de...

EUVD-2016-6200

Malware in sbrugna...

Aladdin - Payload Generation Technique That Allows The Deseriallization Of A .NET Payload And Execution In Memory

Aladdin is a payload generation technique based on the work of James Forshaw @tiraniddo that allows the deseriallization of a .NET payload and execution in memory. The original vector was documented on https://www.tiraniddo.dev/2017/07/dg-on-windows-10-s-executing-arbitrary.html. By spawning the...

InlineExecute-Assembly - A PoC Beacon Object File (BOF) That Allows Security Professionals To Perform In Process .NET Assembly Execution

InlineExecute-Assembly is a proof of concept Beacon Object File BOF that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module. InlineExecute-Assembly will execute any assembly with the entr...

Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization Exploit

This Metasploit module exploits the .NET deserialization vulnerability within the RadAsyncUpload RAU component of Telerik UI ASP.NET AJAX that is identified as CVE-2019-18935. In order to do so the module must upload a mixed mode .NET assembly DLL which is then loaded through the deserialization...

WebSocket C2 Communication Channel: WSC2

WSC2 is a PoC of using the WebSockets and a browser process to serve as a C2 communication channel between an agent, running on the target system, and a controller acting as the actuel C2 server. WSC2 is composed of: a controller, written in Python, which acts as the C2 server an agent running on...

VirtualBox 5.0.32 r112930 x64 - Windows Process COM Injection Privilege Escalation Exploit

Exploit for windows platform in category local exploits Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1103 VirtualBox: Windows Process COM Injection EoP Platform: VirtualBox v5.0.32 r112930 x64 Tested on Windows 10 Class: Elevation of Privilege Summary: The process hardening...

CVE-2016-5249

Lenovo Solution Center LSC before 3.3.003 allows local users to execute arbitrary code with LocalSystem privileges via vectors involving the LSC.Services.SystemService StartProxy command with a named pipe created in advance and crafted .NET assembly...