frida-wshook

frida-wshook frida-wshook es una herramienta de análisis e instrumentación que utiliza frida.re para hookear funciones comunes a menudo utilizadas por archivos de script maliciosos que se ejecutan mediante WScript/CScript. La herramienta intercepta funciones de la API de Windows y no implementa...

CVE-2022-29072

INFORMATION I haven't posted any poc code anywhere for privilege escalation attack. The poc codes found have nothing to do with privilege escalation. For your information. About 7-zip 7-Zip is a free and open-source file archiver. The command line version of 7-Zip is also available for Unix-like...

WhoamiAlternatives

Alternativas a whoami Algunos experimentos para obtener el nombre de usuario actual sin llamar a whoami.exe o binarios similares. Método 1: PRTLUSERPROCESSPARAMETERS Obtener las variables de entorno de la estructura PEB y analizarlas para encontrar el nombre de usuario. La función...

delete-self-poc

🗑️ delete-self-poc The delete-self-poc is a demonstration of a method to delete a locked executable or currently running file from disk. This concept was initially discovered by Jonas Lykkegaard, and I have created the proof of concept POC for it. Additionally, it can be used to delete locked file...

SilentMoonwalk

SilentMoonwalk Implementación de PoC de un spoofeador de pila de llamadas completamente dinámico TL;DR SilentMoonwalk es una implementación de PoC de un spoofeador de pila de llamadas completamente dinámico, que implementa una técnica para eliminar el llamante original de la pila de llamadas,...

gftrace

gftrace Una herramienta de línea de comandos para rastrear llamadas a la API de Windows en binarios de Golang. Nota: Esta herramienta es un PoC y un prototipo en desarrollo, así que por favor trátela como tal. ¡Los comentarios son siempre bienvenidos! ¿Cómo funciona? Aunque los programas Golang...

gftrace

gftrace A command line Windows API tracing tool for Golang binaries. Note: This tool is a PoC and a work-in-progress prototype so please treat it as such. Feedbacks are always welcome! How it works? Although Golang programs contains a lot of nuances regarding the way they are built and their...

instrumentation_callbacks

instrumentationcallbacks Los callbacks de instrumentación son una parte bastante divertida y no documentada de Windows. Todo el código en este repositorio se publica bajo la licencia MIT. Este repositorio utiliza el espaciado de C++ al estilo de Google. Las PRs son bienvenidas si encuentras...

EDRs

EDRs This repo contains information about EDRs that can be useful during red team exercise. patchsyscalldynamically64.c This proof-of-concept is resolving the syscall ID dynamically no need to check the version running on the remote host. To get the information on disk not tampered a call to...

NtDetours

NTSTATUS NTAPI TrInitPVOID ImageBase = &ImageBase; make IAT writable. look for simple.cpp TimedSleepEx calls the real SleepEx API through the TrueSleepEx function pointer. root@kitploit: static DWORD WINAPI TrueSleepExDWORD dwMilliseconds, BOOL bAlertable = SleepEx; DWORD WINAPI TimedSleepExDWORD...

InjectProc

InjectProc Process injection is a very popular method to hide malicious behavior of code and are heavily used by malware authors. There are several techniques, which are commonly used: DLL injection, process replacement a.k.a process hollowing, hook injection and APC injection. Most of them use...

applepie

applepie, a hypervisor implementation for Bochs Hello! Welcome to applepie! This is a tool designed for fuzzing, introspection, and finding bugs! This is a hypervisor using the Windows Hypervisor Platform API present in recent versions of Windows specifically this was developed and tested on...

maldev-for-dummies

Malware Development for Dummies In the age of EDR, red team operators cannot get away with using pre-compiled payloads anymore. As such, malware development is becoming a vital skill for any operator. Getting started with maldev may seem daunting, but is actually very easy. This workshop will sho...

dynmx

dynmx Prototype dynmx spoken dynamics is a signature-based detection approach for behavioural malware features based on Windows API call sequences. In a simplified way, you can think of dynmx as a sort of YARA for API call traces so called function logs originating from malware sandboxes. Hence,...

dynmx

Prototipo de dynmx dynmx pronunciado dynamics es un enfoque de detección basado en firmas para características de comportamiento de malware basado en secuencias de llamadas a la API de Windows. De manera simplificada, puede pensar en dynmx como una especie de YARA para trazas de llamadas a la API...

RtlHijack

RtlHijack A repository with scripts to demonstrate alternative Read and Write primitives using Rtl functions the unintended way. RtlFillMemory.c RtlFillMemory takes three arguments: a pointer to the destination memory, the number of bytes to write, and a single byte value. Writes only a byte into...

go-shellcode

go-shellcode go-shellcode es un repositorio de ejecutores de Shellcode de Windows y utilidades de soporte. Las aplicaciones cargan y ejecutan Shellcode utilizando varias llamadas API o técnicas. Los ejecutores de Shellcode disponibles incluyen: CreateFiber CreateProcess CreateProcessWithPipe...

flare-ida

Code Grafter Function Replacements About Code Grafter Code Grafter is an IDA Python script that makes it possible to use IDA Pro's Bochs IDB Mode to emulate code that imports Windows API functions. Emulation environments like Bochs IDB mode do not resolve or emulate imported functions, resulting ...

windows-api-function-cheatsheets

Windows API Function Cheatsheets Contact 🌨️ Tetsuo: https://www.x.com/tetsuo Table of Contents Windows API Function Cheatsheets File Operations Process Management Memory Management Thread Management Dynamic-Link Library DLL Management Synchronization Interprocess Communication Windows Hooks...

PowerShell-Suite

PowerShell-Suite There are great tools and resources online to accomplish most any task in PowerShell, sometimes however, there is a need to script together a util for a specific purpose or to bridge an ontological gap. This is a collection of PowerShell utilities I put together either for fun or...