ThreadStackSpoofer

Thread Stack Spoofing / Call Stack Spoofing PoC 스레드 호출 스택을 스푸핑하는 고급 인메모리 회피 기법의 PoC 구현입니다. 이 기술은 스레드 기반 메모리 검사 규칙을 우회하고 인-프로세스 메모리에서 셸코드를 더 잘 숨길 수 있게 해줍니다. 소개 이는 검사 중인 스레드의 호출 스택에서 셸코드 프레임에 대한 참조를 찾는 악성코드 분석가, AV 및 EDR을 회피하기 위한 Thread Stack Spoofing 기법의 예제 구현입니다. 아이디어는 스레드의 호출 스택에서 셸코드에 대한 참조를 숨겨...

Shellcode-Hide

このリポジトリには README がありません。...

GPU_ShellCode

gpu poisoning; GPUメモリ内にペイロードを隠す。 以前のリポジトリでは、スレッドの説明を使用してペイロードを隠していました。新しい方法を見つけたかったので、今回はCUDA APIを使用してnividia のGPUメモリを利用し、ペイロードがメモリ内で見つかる必要がない場合に、割り当て、書き込み、解放を行っています。 手順: 1- まず、いくつかの構造体をセットアップして初期化し、VEハンドラーを実行します。 2- 次に、ステージレス ペイロードを実行します。リフレクションがどこに配置されるかを知るには、必ず ステージレスを使用する必要があります（私はcobalt...

FTP Fetch, Hidden Bind Ipknock TCP Stager

Fetch and execute an x86 payload from an FTP server. Listen for a connection. First, the port will need to be knocked from the IP defined in KHOST. This IP will work as an authentication method you can spoof it with tools like hping. After that you could get your shellcode from any IP. The socket...

HTTPS Fetch, Hidden Bind Ipknock TCP Stager

Fetch and execute an x86 payload from an HTTPS server. Listen for a connection. First, the port will need to be knocked from the IP defined in KHOST. This IP will work as an authentication method you can spoof it with tools like hping. After that you could get your shellcode from any IP. The sock...

DeathSleep - A PoC Implementation For An Evasion Technique To Terminate The Current Thread And Restore It Before Resuming Execution, While Implementing Page Protection Changes During No Execution

A PoC implementation for an evasion technique to terminate the current thread and restore it before resuming execution, while implementing page protection changes during no execution. Intro Sleep and obfuscation methods are well known in the maldev community, with different implementations, they...