unicorn

unicorn Written by: Dave Kennedy @HackingDave Website: https://www.trustedsec.com Magic Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's powershell attacks and the powershell bypass technique presented by David...

FUD-UUID-Shellcode

FUD-UUID-Shellcode Introduction Another shellcode injection technique using C++ that attempts to bypass Windows Defender using XOR encryption sorcery and UUID strings madness :. How it works Shellcode generation Firstly, generate a payload in binary format using either Havoc, CobaltStrike or...

NimGetSyscallStub

NimGetSyscallStub Get fresh Syscalls from a fresh ntdll.dll copy. This code can be used as an alternative to the already published awesome tools NimlineWhispers and NimlineWhispers2 by @ajpc500 or ParallelNimcalls. The advantage of grabbing Syscalls dynamically is, that the signature of the Stubs...

K55

K55 - Linux x8664 Process Injection Utility C++14 About K55 pronounced: "kay fifty-five" The K55 payload injection tool is used for injecting x8664 shellcode payloads into running processes. The utility was developed using modern C++11 techniques as well as some traditional C linux functions like...

IIS-Raid

IIS-Raid IS Raid is a native IIS module that abuses the extendibility of IIS to backdoor the web server and carry out custom actions defined by an attacker. Documentation When installed, IIS-Raid will process every request and method, check if the X-Password header exists and compare it against t...

the-backdoor-factory

¡La nueva versión de BACKDOOR FACTORY está disponible! Obtén acceso aquí: https://github.com/sponsors/secretsquirrel ADVERTENCIA: Las Pull Requests SERÁN IGNORADAS Y CERRADAS. The Backdoor Factory BDF Solo para profesionales de la seguridad e investigadores. El objetivo de BDF es parchear binario...

Windows-X64-RAT

Windows x64 Remote Access Trojan RAT Objective Develop a Windows x64 RAT using CVE-2023-38831 WinRAR 6.23 and Shellcode exploitation to bypass Windows Defender. System Description 1. Shellcode Initialization Generate shellcode using Windows/x64 - PIC Null-Free TCP Reverse Shell Shellcode. 2...

wnfexec

Resumen WnfExec es una librería de prueba de concepto en C que inyecta shellcode en un proceso mediante el secuestro de un callback de suscripción WNF y luego desencadenando un cambio de estado. No hay nada novedoso aquí y fue construida basándose en la investigación de otros. Mi intención fue...

RemoteTLSCallbackInjection

Maldev Academy - RemoteTLSCallbackInjection Quick Links Maldev Academy Home Maldev Academy Syllabus Related Maldev Academy Modules New Module 34: TLS Callbacks For Anti-Debugging New Module 35: Threadless Injection Overview This method utilizes TLS callbacks to execute a payload without spawning...

threadfire

threadfire Program uses Thread Hijacking to Inject Native Shellcode into a Standard Win32 Application. I was 15 years old when I made this - please ignore the substandard code. About I developed this small project to continue my experiences of different code injection methods and to allow RedTeam...

MalDev

MalDev Hey! Welcome to my repo : I am Captain Magma, a passionate individual dedicated to cybersecurity, malware development, and analysis. The design for this repository is to manage my MalDev road-path as I learn and update this repository with my notes and code. I am not the author of any of...

OffensiveVBA

OffensiveVBA In preparation for a VBS AV Evasion Stream/Video I was doing some research for Office Macro code execution methods and evasion techniques. The list got longer and longer and I found no central place for offensive VBA templates - so this repo can be used for such. It is very far away...

Shellcode-Injection-Techniques

Shellcode Injection Techniques A collection of C shellcode injection techniques. All techniques use an AES encrypted meterpreter payload. I will be building this project up as I learn, discover or develop more techniques. Note: The project is not intended to be used as-is. If you are going to use...

PELoader

PELoader PELoader implement various shellcode injection techniques, and use libpeconv library to load encrypted PE files instead of injecting shellcode into remote thread. Following techniques were implemented: Module Stomping LoadLibrary Module Stomping NtMapViewOfSection PoC Transacted Hollowin...

GoPurple

GoPurple This project is a simple collection of various shell code injection techniques, aiming to streamline the process of endpoint detection evaluation, beside challenging myself to get into Golang world. Installation 1 - Requires go installed. 2 - Build the application from the project's...

unicorn

unicorn 作者：Dave Kennedy @HackingDave 网站：https://www.trustedsec.com Magic Unicorn 是一个简单工具，用于实施 PowerShell 降级攻击并将 shellcode 直接注入内存。基于 Matthew Graeber 的 PowerShell 攻击方法以及 David Kennedy（TrustedSec）和 Josh Kelly 在 Defcon 18 上展示的 PowerShell 绕过技术。 使用非常简单，只需运行 Magic Unicorn（确保已安装 Metasploit 且路径正确），Magic...

DbgNexum

DbgNexum - Shellcode Injection DbgNexum is a Proof-of-Concept for injecting shellcode using the Windows Debugging API and Shared Memory File Mapping. It avoids writing and reading remote memory directly, instead using context manipulation to force the target process to load and execute the payloa...

SigFlip

What is it ? SigFlip is a tool for patching authenticode signed PE files exe, dll, sys ..etc in a way that doesn't affect or break the existing authenticode signature, in other words you can change PE file checksum/hash by embedding data i.e shellcode without breaking the file signature, integrit...

ShellGhost

ShellGhost A memory-based evasion technique which makes shellcode invisible from process start to end. Motivation I wanted to share this shellcode self-injection POC to showcase some AV/EDR evasion concepts that may turn useful for Red Teaming. Just a few weeks ago I came up with a custom in-memo...

LiquidSnake

Liquid Snake Liquid Snake is a program aimed at performing lateral movement against Windows systems without touching the disk. The tool relies on WMI Event Subscription in order to execute a .NET assembly in memory, the .NET assembly will listen for a shellcode on a named pipe and then execute it...