ExecuteAssembly

Description: ExecuteAssembly is an alternative of CS execute-assembly, built with C/C++ and it can be used to Load/Inject .NET assemblies by; reusing the host spawnto process loaded CLR Modules/AppDomainManager, Stomping Loader/.NET assembly PE DOS headers, Unlinking .NET related modules, bypassi...

MemTracer

MemTracer MemTracer is a tool that offers live memory analysis capabilities, allowing digital forensic practitioners to discover and investigate stealthy attack traces hidden in memory. The MemTracer is implemented in Python language, aiming to detect reflectively loaded native .NET framework...

PortBender

Overview PortBender is a TCP port redirection utility that allows a red team operator to redirect inbound traffic destined for one TCP port e.g., 445/TCP to another TCP port e.g., 8445/TCP. PortBender includes an aggressor script that operators can leverage to integrate the tool with Cobalt Strik...

AceLdr

AceLdr - Avoid Memory Scanners A position-independent reflective loader for Cobalt Strike. Zero results from Hunt-Sleeping-Beacons, BeaconHunter, BeaconEye, Patriot, Moneta, PE-sieve, or MalMemDetect. Features Easy to Use Import a single CNA script before generating shellcode. Dynamic Memory...

RunPE

RunPE C reflective loader for unmanaged binaries. Usage Usage: RunPE.exe e.g. RunPE.exe C:\Windows\System32\net.exe localgroup administrators Alternative usage: RunPE.exe ---f ---b ---a e.g: RunPE.exe ---f C:\Windows\System32\svchost.exe ---b ---a Build configuration options Edit the compilation...

Nim-RunPE

Nim-RunPE A Nim implementation of reflective PE-Loading from memory. The base for this code was taken from RunPE-In-Memory - which I ported to Nim. You'll need to install the following dependencies: nimble install ptrmath winim I did test this with Nim Version 1.6.2 only, so use that version for...

memhunter

Memhunter Automated hunting of memory resident malware at scale This project is WORK IN PROGRESS. Expect feature changes and binary releases on the upcoming weeks. Overview Memhunter is an endpoint sensor tool that is specialized in detecing resident malware, improving the threat hunter analysis...

pe_to_shellcode

petoshellcode PEを通常のシェルコードのようにインジェクション可能に変換します。 （同時に、出力ファイルは有効なPEのままです）。 32ビットおよび64ビットのPEの両方をサポート 作成者:@hasherezade & @hh86 目的 このプロジェクトの目的は、最小限の労力でインジェクション可能なPEファイルを生成する可能性を提供することです。 Stephen...

KaynStrike

KaynStrike A User Defined Reflective Loader for Cobalt Strike Beacon that spoofs the thread start address and frees itself after entry point was executed. Thread Start Address spoofing Reflective Loader cleanup Proof How to use this Just load the KaynStrike.cna agressor script and build a stagele...

patriot

Patriot Small research project for detecting various kinds of in-memory stealth techniques. Download the latest release here. The current version supports the following detections: Suspicious CONTEXT structures pointing to VirtualProtect functions. Targets research by Austin Hudson Foliage and Ek...

BokuLoader

BokuLoader : Cobalt Strike Reflective Loader A proof-of-concept User-Defined Reflective Loader UDRL which aims to recreate, integrate, and enhance Cobalt Strike's evasion features! Contributors: Contributor| Twitter| Notable Contributions ---|---|--- Bobby Cooke| @0xBoku| Project original author...

sRDI

sRDI - Shellcode Reflective DLL Injection sRDI は、DLL ファイルを位置独立シェルコードに変換することを可能にします。適切なセクション権限、TLS コールバック、健全性チェックをサポートする、完全機能の PE ローダーとなることを目指しています。これは、パックされた DLL に取り付けられたシェルコード PE ローダーと考えることができます。 機能は、次の 2 つのコンポーネントによって実現されます。 PE ローダー実装 RDI をシェルコードにコンパイルする C プロジェクト...

PrintSpoofer-ReflectiveDLL

PrintSpoofer Details PrintSpoofer is a tool that performs local privilege escalation by exploiting a vulnerability in the Windows Print Spooler service CVE-2019-1040 / CVE-2019-1019. This project implements the PrintSpoofer exploit in Reflective DLL format, making it suitable for use with...

PowerSploit

Forked to add a few features to PowerView.ps1 that I commonly perform manually This project is no longer supported PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment. PowerSploit is comprised of the following...

NTDLLReflection

NTDLLReflection Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle to ntdll , and trigger exported APIs from the export table...

freeMetsrvLoader

freeMetsrvLoader Fork of freeBokuLoader which targets and frees Metsrv's initial reflective DLL package Usage meterpreter executebof freeMetsrvLoader.x64.o Can be automated with InitialAutoRunScript or AutoRunScript...

freeBokuLoader

freeBokuLoader A simple BOF that tries to free the memory region where the User Defined Reflective Loader is stored. As the name implies, it was tested against BokuLoader, but should work with most if not all UDRLs. Usage beacon freeBokuLoader...

ReflectivePluginLoader

ReflectivePluginLoader Windows x64 向けの、ホットスワップ可能なプラグインインターフェースを備えた最小限のリフレクティブ PE マッパー。メモリ上のバイトバッファから直接 DLL をマッピングし、そのエクスポートを解決し、LoadLibrary に触れることなくクリーンな IPlugin ABI を呼び出す。リフレクティブローダーとモジュール式プラグインアーキテクチャに関するブログ記事のコンパニオンコード。 ブログ記事 完全な解説はこちら: Using Reflective Loaders to Replace LoadLibrary for...

CoercedPotatoRDLL

Coerced Potato Reflective DLL Privilege escalation from NT Service to SYSTEM using SeImpersonateToken privilege and MS-RPRN functions. Heavily based on https://github.com/Prepouce/CoercedPotato Reflective Loader from https://github.com/stephenfewer/ReflectiveDLLInjection. Install Clone this repo...

IronSharpPack

IronSharpPack IronSharpPack は、人気のある C プロジェクトを IronPython スクリプトに埋め込み、AMSI バイパスを実行してから C プロジェクトをリフレクティブ ロードするスクリプト群のリポジトリです。IronPython と DLR にはインストルメンテーションがほとんど あるいはまったく ないため、これらのアセンブリの実行に効果的な言語となっています。これは S3cur3Th1sSh1t の人気プロジェクト PowerSharpPack に触発されたものです。C アセンブリは Flangvik の Sharp Collection...