SneakyEXE

SneakyEXE root@kitploit: /$$$$$$ /$$ /$$$$$$$$ /$$ /$$ /$$$$$$$$ /$$ $$ | $$ | $$/| $$ / $$| $$/ | $$ / /$$$$$$$ /$$$$$$ /$$$$$$ | $$ /$$ /$$ /$$| $$ | $$/ $$/| $$ | $$$$$$ | $$ $$ /$$ $$ | $$| $$ /$$/| $$ | $$| $$$$$ \ $$$$/ | $$$$$ \ $$| $$ \ $$| $$$$$$$$ /$$$$$$$| $$$$$$/ | $$ | $$| $$/ $$ $$ ...

p-invoke.net

p-invoke.net This repository contains most of the P/Invoke definitions from the most-of-the-time offline pinvoke.net, adding the link to the Microsoft documentation for each one. The Gitbook is available at https://ricardojoserf.gitbook.io/pinvoke. Notes I did this to check some definitions in a...

staged-DLL-Injection-SMB-

staged-DLL-Injection Staged DLL injection proof-of-concept built in C using Win32 APIs — developed in an isolated lab environment for red team certification study CRTO. ⚠️ Disclaimer: This project was developed strictly in an isolated lab environment for educational purposes as part of offensive...

recomposer

Recomposer.py Ever have that not so safe feeling uploading your malware binaries to VirusTotal or other AV sites because you can look up binaries by hashes? Example: https://github.com/mubix/vt-notify Feel somewhat safer with Recomposer! Recomposer will take your binary and randomly do the...

charlotte

charlotte c++ fully undetected shellcode launcher ; releasing this to celebrate the birth of my newborn description 13/05/2021: 1. c++ shellcode launcher, fully undetected 0/26 as of 13th May 2021. 2. dynamic invoking of win32 api functions 3. XOR encryption of shellcode and function names 4...

wasmforge

WasmForge WasmForge compiles Go and C programs to WebAssembly, then packages them as single native binaries. The resulting executables sandbox guest code inside a WASM runtime a per-build fork of wazero. From inside that sandbox, guests get transparent access to networking, raw sockets, Win32 API...

sshpass-win32

sshpass-win32 Like https://linux.die.net/man/1/sshpass Pre-Requirements To run sshpass, you must install: Windows 10 Insider build 17733 or later Install Winget root@kitploit: winget install xhcoding.sshpass-win32 Scoop root@kitploit: scoop install sshpass Usage root@kitploit: Usage: sshpass...

CVE-2004-1561

CVE-2004-1561 Icecast Header Overwrite buffer overflow RCE Update for 568-edit.c Managed to get the original exploit to work. Edited according...

XeytanWin32-RAT

WARNING This is a buggy RAT, not completed, not stable. It still a "work in progress" application. Introduction Project created to kill some of my free time, It is not actively maintained. There are a lot of things to improve/fix, and it will take time to reach a stability on this project. Featur...

C2-Hunter

C2-Hunter C2-Hunter is a program designed for malware analysts to extract Command and Control C2 traffic from malwares in real-time. The program uses a unique approach by hooking into win32 connections APIs. With C2-Hunter, malware analysts can now intercept and analyze communication in real-time...

Exploit-Win32.CVE-2017-0147.A

Exploit-Win32.CVE-2017-0147.A the name of virus is the detection of microsoft defender, is the tipic antivirus...

Exploit-Win32.CVE-2012-0158.F.doc

Exploit-Win32.CVE-2012-0158.F.doc имя вируса — это обнаружение Microsoft Defender, это типичный антивирус...

threadfire

threadfire Program uses Thread Hijacking to Inject Native Shellcode into a Standard Win32 Application. I was 15 years old when I made this - please ignore the substandard code. About I developed this small project to continue my experiences of different code injection methods and to allow RedTeam...

thematrix

TheMatrix This project was created to ease the malware analysis process. The goal is to create an activator binary whose purpose is to load a user defined binary and monitor the execution by using Win32 API hooks. Relevant data is then saved to disk. The code supports both x86 and x64 binaries. D...

CVE-2022-47529

CVE-2022-47529 RSA NetWitness Platform EDR Agent / 잘못된 접근 제어 - 코드 실행 EDR 에이전트의 보안 감사 중에, 불안전한 Win32 메모리 이벤트 객체를 대상으로 표준 사용자 권한만으로 서비스를 변조할 수 있는 새로운 벡터를 발견했습니다. 익스플로잇을 관리자로 실행하면 서비스 구성을 가로챌 수도 있습니다. CVE-2022-47529는 로컬 사용자가 엔드포인트 Windows 에이전트가 SIEM으로 이벤트를 전송하는 것을 중단시키거나, 에이전트가 사용자가 제공한 명령을 실행하도록 할 ...

recomposer

Recomposer.py Никогда не чувствовали себя неловко, загружая свои вредоносные бинарники на VirusTotal или другие антивирусные сайты, потому что бинарники можно искать по хешам? Пример: https://github.com/mubix/vt-notify Чувствуйте себя немного увереннее с Recomposer! Recomposer берет ваш бинарный...

Win32_Offensive_Cheatsheet

Win32 Offensive Cheatsheet Win32 and Kernel abusing techniques for pentesters & red-teamers made by @UVision and @RistBS Dev mode enabled, open to any help : Windows Binary Documentation PE structure PE Headers Parsing PE Export Address Table EAT Resolve function address Import Address Table IAT...

D1rkSleep

D1rkSleep Improved version of EKKO by @5pider that Encrypts only Image Sections. Sleep obfuscation technique that uses CreateTimerQueueTimer Win32 API. Credits: https://github.com/Cracked5pider/Ekko...

charlotte

charlotte c++ 완전 미탐지 쉘코드 런처 ; 아이의 탄생을 축하하며 이걸 공개합니다 설명 13/05/2021: 1. c++ 쉘코드 런처, 2021년 5월 13일 기준 완전 미탐지 0/26 2. win32 API 함수 동적 호출 3. 쉘코드 및 함수 이름 XOR 암호화 4. 실행마다 무작위 XOR 키 및 변수 5. Kali Linux에서는 'apt-get install mingw-w64'만 하면 됩니다! 17/05/2021: 6. 무작위 문자열 길이 및 XOR 키 길이 antiscan.me 사용법 저장소를 클론하고,...

CVE-2024-4577-checker

CVE-2024-4577 취약점 검사기 CVE-2024-4577 취약점 검사기는 PHP-CGI의 CVE-2024-4577 취약점을 검사하기 위해 여러 도메인을 스캔하도록 설계된 Bash 스크립트입니다. 이 도구를 통해 보안 연구자와 시스템 관리자는 자신의 시스템 또는 도메인 목록이 이 특정 보안 문제에 잠재적으로 취약한지 신속하게 평가할 수 있습니다. 설명 PHP 8.1. 8.1.29 이전, 8.2. 8.2.20 이전, 8.3. 8.3.8 이전 버전에서 Windows의 Apache 및 PHP-CGI를 사용할 때, 시스템이 특정...