0x4d5a-ctf / 38c3_com_talk
Slides for COM Hijacking AV/EDR Talk on 38c3
☆73Updated 4 months ago
Alternatives and similar repositories for 38c3_com_talk:
Users that are interested in 38c3_com_talk are comparing it to the libraries listed below
- Boilerplate to develop raw and truly Position Independent Code (PIC).☆51Updated 3 months ago
- ForsHops☆44Updated last month
- ☆61Updated 11 months ago
- shell code example☆48Updated 3 weeks ago
- ☆86Updated 8 months ago
- Hooking KPRCB IdlePreselect function to gain execution inside PID 0.☆62Updated 3 weeks ago
- ☆99Updated last year
- ☆58Updated 3 months ago
- ☆105Updated 3 months ago
- Mirage is a PoC memory evasion technique that relies on a vulnerable VBS enclave to hide shellcode within VTL1.☆76Updated 2 months ago
- CVE-2024-30090 - LPE PoC☆106Updated 6 months ago
- "Service-less" driver loading☆154Updated 5 months ago
- I have documented all of the AMSI patches that I learned till now☆72Updated last month
- remote process injections using pool party techniques☆59Updated 2 months ago
- An example reference design for a proposed BOF PE☆163Updated 3 weeks ago
- A simple C++ Windows tool to get information about processes exposing named pipes.☆37Updated 2 months ago
- kernel-mode DLL Injector☆63Updated 2 weeks ago
- Find DLLs with RWX section☆80Updated last year
- Cobaltstrike Reflective Loader with Synthetic Stackframe☆117Updated 3 months ago
- A collection of position independent coding resources☆78Updated 2 months ago
- Malware?☆70Updated 6 months ago
- Indirect Syscall implementation to bypass userland NTAPIs hooking.☆74Updated 8 months ago
- A more reliable way of resolving syscall numbers in Windows☆49Updated last year
- A 64-bit, position-independent code reverse TCP shell for Windows — built in Rust.☆63Updated last week
- Simple POC library to execute arbitrary calls proxying them via NdrServerCall2 or similar☆130Updated 8 months ago
- Splitting and executing shellcode across multiple pages☆101Updated last year
- a modified CONTEXT based ropchain to circumvent CFG-FindHiddenShellcode and EtwTi-FluctuationMonitor☆92Updated last year
- MIPS VM to execute payloads without allocating executable memory. Based on a PlayStation 1 (PSX) Emulator.☆113Updated 5 months ago
- ☆45Updated last month
- ☆36Updated 5 months ago