AceLdr

AceLdr - Éviter les scanners mémoire Un chargeur réflexif indépendant de la position pour Cobalt Strike. Zéro résultat de Hunt-Sleeping-Beacons, BeaconHunter, BeaconEye, Patriot, Moneta, PE-sieve, ou MalMemDetect. Fonctionnalités Facile à utiliser Importez un seul script CNA avant de générer le...

BokuLoader

BokuLoader : Chargeur Réflexif pour Cobalt Strike Une preuve de concept de Chargeur Réflexif Défini par l'Utilisateur UDRL qui vise à recréer, intégrer et améliorer les fonctionnalités d'évasion de Cobalt Strike ! Contributeurs :...

CrabLoader

CrabLoader Рефлективный загрузчик пользовательского типа User-Defined Reflective Loader для Cobalt Strike, написанный целиком на Rust. Мне просто было интересно, насколько сложно его создать. Оказалось, не так уж и сложно. Возможно, когда-нибудь я добавлю функцию обфускации сна. Сейчас это просто...

Astral_Projection

Astral Projection - UDRL Astral Projection est un UDRL User-Defined Reflective Loader pour Cobalt Strike qui effectue un « module stomping » avancé. L'UDRL charge un module via LoadLibraryExW, puis manipule ses structures internes en installant un VEH pour intercepter des appels stratégiques. Cel...

CustomC2ChannelTemplate

사용자 지정 C2 채널을 위한 IAT 후킹 이것은 리플렉티브 로더가 적용한 IAT 후크를 사용하여 Cobalt Strike용 사용자 지정 C2 채널을 개발하기 위한 간단한 PoC 및 템플릿입니다. 블로그 게시물: https://codex-7.gitbook.io/codexs-terminal-window/red-team/cobalt-strike/building-custom-c2-channels-by-hooking-wininet TCP 채널 데모 gif 사용법 customCallback.h, hook.c, hash.h 및 hook....

patriot

Patriot Small research project for detecting various kinds of in-memory stealth techniques. Download the latest release here. The current version supports the following detections: Suspicious CONTEXT structures pointing to VirtualProtect functions. Targets research by Austin Hudson Foliage and Ek...

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

KaynStrike

KaynStrike Пользовательский рефлективный загрузчик для Cobalt Strike Beacon, который подделывает стартовый адрес потока и освобождает себя после выполнения точки входа. Подмена стартового адреса потока Очистка рефлективного загрузчика Доказательство Как использовать Просто загрузите агрессор-скри...

BokuLoader

BokuLoader : Cobalt Strike Reflective Loader Cobalt Strike의 회피 기능을 재현, 통합, 개선하는 것을 목표로 하는 개념 증명PoC용 User-Defined Reflective Loader UDRL입니다! 기여자:...

RunPE

RunPE C рефлексивный загрузчик для неуправляемых бинарных файлов. Использование root@kitploit: Usage: RunPE.exe e.g. RunPE.exe C:\Windows\System32\net.exe localgroup administrators Alternative usage: RunPE.exe ---f ---b ---a e.g: RunPE.exe ---f C:\Windows\System32\svchost.exe ---b ---a Параметры...

freeBokuLoader

freeBokuLoader Ein einfacher BOF, der versucht, den Speicherbereich freizugeben, in dem der User Defined Reflective Loader gespeichert ist. Wie der Name schon andeutet, wurde er gegen BokuLoader getestet, sollte aber mit den meisten, wenn nicht allen UDRLs funktionieren. Verwendung root@kitploit:...

AtlasLdr

Atlas è un loader riflessivo x64 che ha le seguenti funzionalità: Funzionalità Recupero di DLL e PE da un server remoto Mapping manuale su un processo remoto Cancellazione del DOS Header e dei byte magic dell'NT Header Codice indipendente dalla posizione Uso di syscall indirette ZwOpenProcess...

ProcessStomping - A Variation Of ProcessOverwriting To Execute Shellcode On An Executable'S Section

A variation of ProcessOverwriting to execute shellcode on an executable's section What is it For a more detailed explanation you can read my blog post Process Stomping, is a variation of hasherezade’s Process Overwriting and it has the advantage of writing a shellcode payload on a targeted sectio...

Windows Inject Reflective PE Files, Bind TCP Stager (RC4 Stage Encryption, Metasm)

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...

Windows Inject PE Files, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...

Windows Inject PE Files, Bind IPv6 TCP Stager (Windows x86)

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...

Windows Inject PE Files, Hidden Bind Ipknock TCP Stager

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...

Windows Inject PE Files, Reverse TCP Stager

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...

Windows Inject PE Files, Find Tag Ordinal Stager

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...

Windows Inject PE Files, Bind TCP Stager (Windows x86)

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...