dll-injector

소개 이름에서 알 수 있듯이, 이 애플리케이션은 주로 Windows에서 실행 중인 모든 프로세스에 DLL을 인젝션하는 기능을 수행합니다. 이 기능을 통해 DLL 로드, DLL 언로드, 주요 WinAPI 함수예: CreateFileW, ReadFile 등 후킹과 같은 여러 작업을 프로세스에 수행할 수 있습니다. 프론트엔드는 Flutter 로 구축되었으며, 핵심 기능은 C++을 사용하여 수행됩니다. 이 프로젝트는 Windows 프로세스의 디버깅 및 동작 수정을 위한 단순화되고 효과적인 도구의 부족을 해소합니다. 현재 도구들은...

thats_no_pipe

那不是管道 基于 Frida 的项目，用于拦截 Windows 命名管道通信 目标 本项目旨在通过 Hook 特定的 WinAPI 函数，并使用 WebSocket 将其转发到 HTTP 代理，从而拦截 IPC 通信。 架构 对命名管道的读取和写入可能发生在不同的函数中。在本节中，WriteFile 表示对命名管道的写入，ReadFile 表示对命名管道的读取。 被拦截时，待写入的数据遵循以下模式。 root@kitploit: WriteFile -- frida hook -- python process -- websocket client -- HTTP Proxy --...

ScreenshotBOF

ScreenshotBOF Cobalt Strike를 위한 대체 스크린샷 기능으로, WinAPI를 사용하며 fork & run을 수행하지 않습니다. 스크린샷이 메모리에서 다운로드됩니다. 기능 JPEG 압축 스크린샷 또는 파일로 메모리 내 다운로드 최소화된 창 캡처 지원 회색조, JPEG 품질 및 축소를 통한 파일 크기 감소 자체 컴파일 1. git clone the repo 2. make 실행 저장 방법: 0. 파일을 디스크에 저장 1. 비콘을 통해 파일 다운로드 Cobalt Strike 전용 2. 비콘을 통해 스크린샷으로 파일...

LightsOut

LightsOut LightsOut는 AMSI & ETW를 비활성화하면서 AV를 회피하려는 난독화된 DLL을 생성합니다. 이는 사용된 모든 WinAPI 함수를 무작위화하고, 문자열을 xor 인코딩하며, 기본 샌드박스 검사를 활용하여 수행됩니다. Mingw-w64는 난독화된 C 코드를 AMSI나 ETW가 존재하는 모든 프로세스예: PowerShell에 로드할 수 있는 DLL로 컴파일하는 데 사용됩니다. LightsOut는 python3와 mingw-w64가 설치된 Linux 시스템에서 작동하도록 설계되었습니다. 다른 종속성은...

MalwareApiLibrary

MalwareApiLibrary : マルウェア開発に使用されるAPIのコレクション : StringManagementLib : 文字列、文字列ハッシュなどの管理 WinApiManagementLib : GetModuleHandle 関数と GetProcAddress 関数の代替 SyscallsManagementLib : Hellsgate、TartarusGate、PerunsFart（現時点では）を実行して syscall のフックを解除する リファレンス: VX-API TODO: アンチデバッグライブラリ ペイロード実行ライブラリ 永続化ライブラリ バグを修正...

AntiDebug-AntiVM

AntiDebug/AntiVM 目的 このリポジトリには、WinAPIを調査している際に出会ったさまざまなデバッグ/VM検出方法を掲載しています。これはコンパイルして実行することを目的としたものではなく、既存のプロジェクトにこれらのさまざまな方法を実装する方法の例を示すためのものです。AntiDebugフォルダとAntiVMフォルダ内の各ファイルは独立して参照できるため、GetModuleHandleが使用されているのもそのためです。...

OffensiveCpp

OffensiveCpp Offensive C++ は、C++ で書かれたオフェンシブセキュリティのスニペット集です。ペネトレーションテストやエクスプロイト開発のためのさまざまなツールが含まれています。 目次 OffensiveCpp はじめに なぜ C/C++ なのか？ コンパイル 参考ライブラリ コントリビューション ライセンス はじめに このプロジェクトの目的は、ペネトレーションテストやエクスプロイト開発に使用できるスニペットのコレクションを提供することです。現在、このプロジェクトには以下のスニペットが含まれています： AV/EDR 回避 列挙 サンドボックス回避 シェルコード実...

LightsOut - Generate An Obfuscated DLL That Will Disable AMSI And ETW

LightsOut will generate an obfuscated DLL that will disable AMSI & ETW while trying to evade AV. This is done by randomizing all WinAPI functions used, xor encoding strings, and utilizing basic sandbox checks. Mingw-w64 is used to compile the obfuscated C code into a DLL that can be loaded into a...

NoFilter Attack: Sneaky Privilege Escalation Method Bypasses Windows Security

A previously undetected attack method called NoFilter has been found to abuse the Windows Filtering Platform WFP to achieve privilege escalation in the Windows operating system. "If an attacker has the ability to execute code with admin privilege and the target is to perform LSASS Shtinkering,...

Inside Raccoon Stealer V2

Raccoon Stealer is back on the news again. US officials arrested Mark Sokolovsky, one of the malware actors behind this program. In July 2022, after several months of the shutdown, a Raccoon Stealer V2 went viral. Last week, the Department of Justice's press release stated that the malware...

Scemu - X86 32bits Emulator, For Securely Emulating Shellcodes

x86 32bits emulator, for securely emulating shellcodes. Features  rust safety, good for malware. All dependencies are in rust. zero unsafe blocks. very fast emulation much faster than unicorn 3,000,000 instructions/second 100,000 instructions/second printing every instruction -vv. powered by...

ThreadBoat - Program Uses Thread Execution Hijacking To Inject Native Shell-code Into A Standard Win32 Application

Program uses Thread Hijacking to Inject Native Shellcode into a Standard Win32 Application. About I developed this small project to continue my experiences of different code injection methods and to allow RedTeam security professionals to utilize this method as a unique way to perform software...

NetProfiler

On .NET 4, the CLSID must be defined via the HKCR\CLSIDGUID\InprocServer32 registry key containing the path to the profiling DLL. On recent versions, the CLR uses the CORPROFILERPATH environment variable to find the DLL – and falls back to using the CLSID if CORPROFILERPATH is not defined. Author...

ThreadBoat - Program Uses Thread Execution Hijacking To Inject Native Shellcode Into A Standard Win32 Application

Program uses Thread Hijacking to Inject Native Shellcode into a Standard Win32 Application. With Thread Hijacking, it allows the hijacker.exe program to suspend a thread within the target.exe program allowing us to write shellcode to a thread. Usage int main System sys; Interceptor incp; Exceptio...

Plurox: Modular backdoor

In February this year, a curious backdoor passed across our virtual desk. The analysis showed the malware to have a few quite unpleasant features. It can spread itself over a local network via an exploit, provide access to the attacked network, and install miners and other malicious software on...

SynAck targeted ransomware uses the Doppelgänging technique

The Process Doppelgänging technique was first presented in December 2017 at the BlackHat conference. Since the presentation several threat actors have started using this sophisticated technique in an attempt to bypass modern security solutions. In April 2018, we spotted the first ransomware...

Symantec Endpoint Protection 12.1.6 Tamper Protection Bypass

Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-6331-SYMANTEC-ENDPOINT-PROTECTION-TAMPER-PROTECTION-BYPASS.txt + ISR: ApparitionSec Vendor: ======= www.symantec.com Product: =========== Symantec Endpoint...

Symantec Endpoint Protection 12.1 - Tamper-Protection Bypass

Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-6331-SYMANTEC-ENDPOINT-PROTECTION-TAMPER-PROTECTION-BYPASS.txt + ISR: ApparitionSec Vendor: ======= www.symantec.com Product: =========== Symantec Endpoint...

Symantec Endpoint Protection 12.1 - Tamper-Protection Bypass

Symantec Endpoint Protection 12.1 - Tamper-Protection Bypass + Credits: John Page a.k.a hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/CVE-2017-6331-SYMANTEC-ENDPOINT-PROTECTION-TAMPER-PROTECTION-BYPASS.txt + ISR: ApparitionSec Vendor: =======...

Pentesting Active Directory Environments: CrackMapExec

Pentesting Active Directory Environments: CrackMapExec CrackMapExec a.k.a CME is a post-exploitation tool that helps automate assessing the security of large Active Directory networks. Built with stealth in mind, CME follows the concept of “Living off the Land”: abusing built-in Active Directory...