-
When I create a reflective payload a stager (to download and execute it in memory) is not created as previously.
-
# Description
The included `ext_server_unhook.x64.dll` doesn't work as expected since the user-land hooks are not removed.
## Steps to reproduce
```
1. use exploit/multi/script/web_delivery
…
-
### What is not perfect about usermode hooks?
**Currently, they are equipped only when DRAKVUF starts.** The assumption is that there would be at least one program running in the system, which has th…
-
https://github.com/Mecanik/MecanikProcessBreaker
Use this replacing netredirect or Use net redirect to forge packets what u think It uses syscall. @allanon,@itsrachelfish @alisonrag @sctnightcore…
ghost updated
4 years ago
-
- Option to encode shellcode with base64.
Some users may encode payload before using with a .NET tool for process injection. Would users want the option of encoding the shellcode before saving to dis…
-
If the DEP is disabled for the process, shellcode can be also executed from a non-executable page.
PE-sieve should be able to detect what DEP policy applies on the particular process, and if needed…
-
[FLOSS](https://github.com/fireeye/flare-floss) is a tool which should not lack in an analyst's toolbox. As such, I think it'd be a great idea to use it as the default strings tool in CAPE. Its licens…
-
**Describe the bug**
Loading MSF payload crashes x64 Sliver instanceson Windows. (I haven't tried this on 32-bit)
**To Reproduce**
Steps to reproduce the behavior:
1. Generate a Sliver with `gen…
v-p-b updated
5 years ago
-
Multiple [ShadowHammer](https://securelist.com/operation-shadowhammer/89992/) samples decrypt their shellcode via a function called from `___crtExitProcess()`. The screenshot below is MD5 `cdb0a090678…
-
I want to get the exception memory address and length.So I can map the memory to jitter dynamicaly.But how can I get the exception address and length in the exception handler for EXCEPT_ACCESS_VIOL?Al…