VirtualAlllocEx / DSC_SVC_REMOTE
This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for local privilege escalation in the context of an unquoted service path, etc. The payload itself can be remotely hosted, downloaded via the wininet library and then executed via direct system calls.
☆51Updated 2 years ago
Alternatives and similar repositories for DSC_SVC_REMOTE
Users that are interested in DSC_SVC_REMOTE are comparing it to the libraries listed below
Sorting:
- A small Aggressor script to help Red Teams identify foreign processes on a host machine☆85Updated 2 years ago
- DLL Exports Extraction BOF with optional NTFS transactions.☆82Updated 3 years ago
- ☆59Updated last year
- in-process powershell runner for BRC4☆45Updated last year
- HelpSystems Nanodump, but wrapped in powershell via Invoke-ReflectivePEInjection☆55Updated 3 years ago
- Lateral Movement via the .NET Profiler☆81Updated 5 months ago
- Programmatically start WebClient from an unprivileged session to enable that juicy privesc.☆74Updated 2 years ago
- lsassdump via RtlCreateProcessReflection and NanoDump☆82Updated 6 months ago
- a variety of tools,scripts and techniques developed and shared with different programming languages by 0xsp Lab☆63Updated 4 months ago
- ☆48Updated 2 years ago
- Simple .NET loader for loading and executing Powershell payloads☆16Updated 3 years ago
- C# havoc implant☆99Updated 2 years ago
- Creation and removal of Defender path exclusions and exceptions in C#.☆31Updated last year
- Proof of Concept code and samples presenting emerging threat of MSI installer files.☆81Updated 2 years ago
- Run Cobalt Strike BOFs in Brute Ratel C4!☆66Updated 3 weeks ago
- A PoC weaponising CustomXMLPart for hiding malware code inside of Office document structures.☆39Updated 2 years ago
- ☆106Updated 2 months ago
- Modified versions of the Cobalt Strike Process Injection Kit☆94Updated last year
- Some of the presentations, workshops, and labs I gave at public conferences.☆33Updated last week
- A repository with my code snippets for research/education purposes.☆50Updated last year
- ☆48Updated last year
- Section-based payload obfuscation technique for x64☆59Updated 9 months ago
- Click Once + App Domain☆62Updated last year
- A care package of useful bofs for red team engagments☆55Updated 5 months ago
- Rewrite to fit my needs☆27Updated 9 months ago
- Duplicate not owned Token from Running Process☆72Updated last year
- a simple poc showcasing the ability of an admin to suspend EDR's protected processes , making it useless☆38Updated 10 months ago
- SAM Dumping in C#☆48Updated 3 months ago
- Unchain AMSI by patching the provider’s unmonitored memory space☆90Updated 2 years ago
- Just another ntdll unhooking using Parun's Fart technique☆75Updated 2 years ago