6 matches found
ThreadStackSpoofer
线程栈欺骗 / 调用栈欺骗概念验证 一种高级内存驻留规避技术的概念验证实现，用于欺骗线程调用栈。该技术可绕过基于线程的内存检查规则，在进程内存中更好地隐藏 shellcode。 简介 本示例实现了 线程栈欺骗 技术，旨在规避恶意软件分析师、AV 和 EDR 通过检查线程调用栈中 shellcode 帧的引用。其核心思路是隐藏线程调用栈中指向 shellcode 的引用，从而伪装包含恶意代码的内存分配。 本实现与我的 ShellcodeFluctuation 一起，为红队工具提供了与商业 C2 产品相媲美的示例，让我们在红队工具中不落下风。💪 实现已变更...
GPU_ShellCode
GPU 投毒；将载荷隐藏在 GPU 内存中。 在我之前的 repo（我用线程描述来隐藏载荷）之后，我想找一种新方法，所以现在我使用 nividia GPU 内存，借助 cuda api 来分配、写入并在不需要让载荷在内存中被发现时释放。 步骤： 1- 首先，我们需要设置并初始化一些结构体 / 并运行我们的 ve 处理器。 2- 第二，我们运行 stageless （无阶段）载荷，我们必须 使用 stageless，以便知道反射会落在哪里 （我用的是 cobalt strike，它使用 dll 反射加载器），我们只关心 2nd stage，因为那才是真正的...
FTP Fetch, Hidden Bind Ipknock TCP Stager
Fetch and execute an x86 payload from an FTP server. Listen for a connection. First, the port will need to be knocked from the IP defined in KHOST. This IP will work as an authentication method you can spoof it with tools like hping. After that you could get your shellcode from any IP. The socket...
HTTPS Fetch, Hidden Bind Ipknock TCP Stager
Fetch and execute an x86 payload from an HTTPS server. Listen for a connection. First, the port will need to be knocked from the IP defined in KHOST. This IP will work as an authentication method you can spoof it with tools like hping. After that you could get your shellcode from any IP. The sock...
DeathSleep - A PoC Implementation For An Evasion Technique To Terminate The Current Thread And Restore It Before Resuming Execution, While Implementing Page Protection Changes During No Execution
A PoC implementation for an evasion technique to terminate the current thread and restore it before resuming execution, while implementing page protection changes during no execution. Intro Sleep and obfuscation methods are well known in the maldev community, with different implementations, they...