spawn

SPAWN - Cobalt Strike BOF Cobalt Strike BOF로, 희생 프로세스를 생성하고, 쉘코드를 주입한 후 페이로드를 실행합니다. Arbitrary Code GuardACG, BlockDll, PPID 스푸핑을 사용하여 희생 프로세스를 생성함으로써 EDR/UserLand 후킹을 우회하도록 설계되었습니다. ACG로 인해, 이 BOF는 다음 기능에 의존하는 쉘코드를 지원하지 않습니다: RW/RX 간 메모리 권한 전환. RWX 메모리 위 기능에 의존하는 생성된 프로세스에 쉘코드를 주입하려면 Hollow BOF...

MalSeclogon

MalSeclogon Seclogon サービスを操作するための小さなツールです。 技術的な詳細はこちら: https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-2.html https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html 使用法 MalSeclogon v0.2 @splintercode 引数: -p seclogon サービスを通じて PPID を偽装するプロセスの PID -d lsass...

ppid-spoofing

https://www.countercept.com/blog/detecting-parent-pid-spoofing/...

laZzzy

laZzzy laZzzy는 악성코드에서 일반적으로 사용되는 다양한 실행 기법을 보여주는 셸코드 로더입니다. laZzzy는 다양한 오픈소스 헤더 전용 라이브러리를 사용하여 개발되었습니다. 특징 직접 시스템 콜 및 네이티브 Nt 함수 모든 함수는 아니지만 대부분 IATImport Address Table 우회 암호화된 페이로드 XOR 및 AES 무작위로 생성된 키 페이로드의 자동 패딩 필요 시 NOPS\x90 사용 페이로드의 바이트 단위 메모리 내 복호화 XOR 암호화된 문자열 PPID 스푸핑 비 Microsoft 서명 DLL 차...

DarkWidow

DarkWidow Windows를 대상으로 하는 사용자 정의 가능한 드로퍼 도구입니다. 감사의 말: 1. BlackHat Asia, 2024 - 도구 제안 요청 2. BlackHat USA, 2024 - 도구 제안 요청 3. BlackHat SecTor, 2024 - 도구 제안 요청 4. BlackHat Europe, 2024 - 도구 제안 요청 5. Wild West Hacking Fest 2024 - Arsenal Soumyadeep Da 일명 @SoumyadeepBas12님께 이 컨퍼런스에 지원하도록 격려해 주셔서 정말...

Ares

Project Ares Project Ares Injector Project Ares Injector는 Transacted Hollowing 기술을 기반으로 C/C++로 작성된 개념 증명PoC 로더입니다. 이 로더는 원격 프로세스에 PE를 주입하며 다음과 같은 기능을 제공합니다: PPID 스푸핑 비 Microsoft 서명 바이너리를 차단하는 CIG LoadLibrary 또는 GetProcAddress API 없이 동적 함수 해결 API 해싱 디스크의 깨끗한 버전으로 .text 섹션을 새로고침하여 NTDLL 언후킹 WIN32 A...

SelectMyParent

これは何ですか これは親プロセススプーフィングのためのプロジェクトです。 使い方 ステップ1:親プロセスを選択し、pidを覚えておいてください ステップ2:以下のコマンドを実行して、親プロセススプーフィングを実施します SelectMyParent.exe notepad 928 ステップ3:プロセスエクスプローラーを使用してプロセスツリーを表示すると、スプーフィングが成功したことを確認できます 参考 https://pentestlab.blog/2020/02/24/parent-pid-spoofing...

SUSE CVE-2026-46259

In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading realparent in dotaskstat When reading /proc/pid/stat, dotaskstat accesses task-realparent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- dotaskstat var =...

CVE-2026-46259

In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading realparent in dotaskstat When reading /proc/pid/stat, dotaskstat accesses task-realparent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- dotaskstat var =...

TerraLdr - A Payload Loader Designed With Advanced Evasion Features

TerraLdr: A Payload Loader Designed With Advanced Evasion Features Details: no crt functions imported syscall unhooking using KnownDllUnhook api hashing using Rotr32 hashing algo payload encryption using rc4 - payload is saved in .rsrc process injection - targetting 'SettingSyncHost.exe' ppid...

laZzzy - Shellcode Loader, Developed Using Different Open-Source Libraries, That Demonstrates Different Execution Techniques

laZzzy is a shellcode loader that demonstrates different execution techniques commonly employed by malware. laZzzy was developed using different open-source header-only libraries. Features Direct syscalls and native Nt functions not all functions but most Import Address Table IAT evasion Encrypte...

Shhhloader - SysWhispers Shellcode Loader

Shhhloader is a SysWhispers Shellcode Loader that is currently a Work in Progress. It takes raw shellcode as input and compiles a C++ stub that has been integrated with SysWhispers in order to bypass AV/EDR. The included python builder will work on any Linux system that has Mingw-w64 installed. T...

DInjector - Collection Of Shellcode Injection Techniques Packed In A D/Invoke Weaponized DLL

This repository is an accumulation of my code snippets for various shellcode injection techniques using fantastic D/Invoke API by @TheWover and @FuzzySecurity. Features: Fully ported to D/Invoke API Encrypted payloads which can be invoked from a URL or passed in base64 as an argument Built-in AMS...

Sharperner - Simple Executable Generator With Encrypted Shellcode

Sharperner is a tool written in CSharp that generate .NET dropper with AES and XOR obfuscated shellcode. Generated executable can possibly bypass signature check but I cant be sure it can bypass heuristic scanning. Features PE binary Process Hollowing PPID Spoofing Random generated AES key and iv...

TAU Threat Intelligence Notification: PPID Spoofing – Explorer CLSID

Summary Popular Attack Surface Reduction bypasses allow adversaries to hinder threat hunting activities by spoofing Parent Process ID. PPID to PID relationships have always been a key indicator of compromise and removing these conditions lead to false sense of security. Upon investigation its bee...

Windows Manage Process Migration

This module will migrate a Meterpreter session from one process to another. A given process PID to migrate to or the module can spawn one and migrate to that newly spawned process. This module requires Metasploit: https://metasploit.com/download Current source:...

linux/x86 examples of long-term payloads hide-wait-change 187 bytes+

No description provided by source. /---------------------------------------------------------------------------- Mystique Project: Examples of long-term payloads hide-wait-change code by [email protected] & [email protected] ----------------------------------------------------------------------------...