18 matches found
Noriben
Noriben マルウェア分析サンドボックス root@kitploit: 連絡先情報: @bbaskin on Twitter brian at thebaskins dot com Noribenは、Sysinternals Procmonと連携してマルウェアのランタイムインジケーターを自動的に収集、分析、レポートするPythonベースのスクリプトです。簡単に言うと、アプリケーションを実行し、キーを押すだけで、サンプルのアクティビティのシンプルなテキストレポートを取得できます。...
ImpulsiveDLLHijack
ImpulsiveDLLHijack 基于C的工具，可自动发现和利用目标二进制文件中的DLL劫持漏洞。劫持路径可在红队行动中用于绕过EDR。 1. 方法论： 该工具主要实现DLL劫持中以下阶段的自动化： 发现 - 查找潜在可利用的DLL劫持路径 利用 - 确认目标是否从劫持路径加载了验证DLL，从而确认100%可利用的DLL劫持！ 发现方法论： 向 ImpulsiveDLLHijack.exe 提供目标二进制路径 自动执行 ProcMon 并同时运行目标二进制，查找潜在可利用的DLL劫持路径 利用方法论： 从 ProcMon 自动生成的 CSV 文件中解析潜在可利用的DLL劫持路径...
Anvil
面向 Windows 胖客户端的运行时优先权限提升与攻击面评估工具。 Anvil 是一款面向 Windows 胖客户端应用程序的运行时优先权限提升与攻击面评估工具。它并非盲目扫描文件系统，而是将 Procmon 捕获与 Windows AccessCheck 相结合，仅报告运行时实际观察到 并且 经确认可由标准用户写入的路径，从而消除了通用枚举工具中普遍存在的误报噪音。 目录 主要功能 工作原理 模块 环境要求 Sysinternals 工具 安装 分发 使用方法 示例 输出 严重等级模型 过滤器 免责声明 主要功能 大多数胖客户端评估工具仅覆盖一两种攻击类别。Anvil...
Spartacus
!CAUTION 此仓库已不再维护，请访问 https://github.com/sadreck/Spartacus 获取最新版本。 Spartacus DLL/COM 劫持工具包 为什么叫“Spartacus”？ 如果你看过1960年的电影《斯巴达克斯》，你会记得罗马人要求斯巴达克斯自首的场景。当真正的斯巴达克斯站起来时，其他人也纷纷站起来，用“我是斯巴达克斯”这句话声称自己就是他。 当一个容易受到DLL劫持攻击的进程要求加载一个DLL时，它就像在问“谁是 version.dll？”然后随机目录开始声称“我是 version.dll”和“不，我是 version.dll”。这就是...
fingerprint
fingerprint Monitoreo de cambios en el Registro y Archivos en Windows - análisis forense para el registro y archivos de Windows "fingerprint" registra el estado de un sistema Windows, en términos de archivos y registro. Estas huellas digitales se pueden comparar para encontrar todos los datos...
VISION-ProcMon
关于 VISION-ProcMon 是一款专用于恶意软件分析，特别是执行行为分析的工具。VISION-ProcMon 结合使用 Rust 和 Web 技术，以便在使用 ProcMon 工具捕获恶意软件的活动后，快速且更好地可视化其行为。VISION-ProcMon 并非为希望调查进程以进行调试的系统管理员而设计。 使用场景 VISION-ProcMon 为了更深入地了解该工具的功能，您可以查看这篇博客文章，其中演示了使用 VISION-ProcMon 对恶意软件进行行为分析：https://www.forensicxlab.com/posts/vision-procmon/ 安装...
Canadian Furious Beaver - A Tool For Monitoring IRP Handler In Windows Drivers, And Facilitating The Process Of Analyzing, Replaying And Fuzzing Windows Drivers For Vulnerabilities
Furious Beaver is a distributed tool for capturing IRPs sent to any Windows driver. It operates in 2 parts: 1. the "Broker" combines both a user-land agent and a self-extractable driver IrpDumper.sys that will install itself on the targeted system. Once running it will expose depending on the...
ImpulsiveDLLHijack - C# Based Tool Which Automates The Process Of Discovering And Exploiting DLL Hijacks In Target Binaries
C based tool which automates the process of discovering and exploiting DLL Hijacks in target binaries. The Hijacked paths discovered can later be weaponized during RedTeam Operations to evade EDR's. 1. Methodological Approach : The tool basically acts on automating following stages performed for...
Acronis: Local Privilege Escalation via EXE hijacking with Acronis True Image 2021 - Acronis Scheduler2 Service
Vulnerability description not provided...
Acronis: Arbitrary DLL injection in mmsminisrv (Acronis Managed Machine Service Mini)
During initialization, mmsmini.exe service binary of mmsminisrv loads library C:\Program Files x86\Common Files\Acronis\Home\libssl10.dll. The library then tries to load non-existing file: C:\bshudson\workspace\mod-openssl-fips-win\205\product\out\standard\vs2013release\OpenSSL\ssl\openssl.cnf. T...
Microsoft Windows 10 (17763.379) - Install DLL
Microsoft Windows 10 17763.379 - Install DLL edit: Figure out how this works for yourself. I can't be bothered. It's a really hard race, doubt anyone will be able to repro anyway. Could be used with malware, you could programmatically trigger the rollback. Maybe you can even pass the silent flag ...
Setting ProcMon to run at a lower altitude to capture other filter drivers
If you need to get Procmon's filter to run below us in the filter stack, it has a setting for that. Procmon is usually used to figure out what is happening on the machine, but you do not get to see the activity of things such as virus scanners and unifiltr because they happen at a lower level tha...
Visual Malware Analysis: ProcDOT
Visual Malware Analysis There are plenty of tools for behavioral malware analysis. The defacto standard ones, though, are Sysinternals’s Process Monitor also known as Procmon and PCAP generating network sniffers like Windump, Tcpdump, Wireshark, and the like. These “two” tools cover almost...
Portable Malware Analysis Sandbox: Noriben
Portable Malware Analysis Sandbox Noriben is a Python-based script that works in conjunction with Sysinternals Procmon to automatically collect, analyze, and report on runtime indicators of malware. In a nutshell, it allows you to run your malware, hit a keypress, and get a simple text report of...
Noriben - Portable, Simple, Malware Analysis Sandbox
Noriben is a Python-based script that works in conjunction with Sysinternals Procmon to automatically collect, analyze, and report on runtime indicators of malware. In a nutshell, it allows you to run your malware, hit a keypress, and get a simple text report of the sample's activities. Noriben...
Noriben - Your Personal, Portable Malware Sandbox
Noriben is a Python-based script that works in conjunction with Sysinternals Procmon to automatically collect, analyze, and report on runtime indicators of malware. In a nutshell, it allows you to run your malware, hit a keypress, and get a simple text report of the sample's activities. Noriben...
Google Chrome Browser (ChromeHTML://) Remote Parameter Injection
No description provided by source. !-- Google Chrome Browser ChromeHTML:// remote parameter injection POC by Nine:Situations:Group::bellick&strawdog Site: http://retrogod.altervista.org/ tested against: Internet Explorer 8 beta 2, Google Chrome 1.0.154.36, Microsoft Windows XP SP3 List of command...