몾 Artemis @mixic@nanao.cybtex.fr

• LPE via StorSvc

Windows LPE via StorSvc (writable SYSTEM path DLL hijacking)

https://github.com/blackarrowsec/redteam-research

• MISC peripper

Inject and dump executable code bytes from PE file. Output ̀-f` (format: CSharp | Python)

https://github.com/daem0nc0re/TangledWinExec/tree/main/Misc#peripper

Beacon Object Files

• BackdoorSCManager/entry.c

Need an almost invisible, post-exploitation, persistent, fileless, LPE backdoor? There are many, but this one looks really beautiful for me: type « sc.exe sdset scmanager D:(A;;KA;;;WD) » from an elevated command prompt.

https://github.com/snovvcrash/BOFs

PSBits

• Misc/BreakChain.c

Simple PoC for self-breaking own parent-child process chain

https://github.com/gtworek/PSBits

Jarviz v0.2.0

JAR file analyzer. Metadata from a JAR such as its manifest, manifest entries, bytecode versions, declarative services, module descriptors and more

https://github.com/kordamp/jarviz

JBang 0.104.0

Run Java code directly.

https://github.com/jbangdev/jbang

PingCastle 3.0.0.0

https://github.com/vletoux/pingcastle/releases/

Fast Web Fuzzer v2.0.0

https://github.com/ffuf/ffuf

haiti v1.5.0

hash type identifier

https://github.com/noraj/haiti

PowerShellAI

A collection of powerful PowerShell scripts that will enable you to easily integrate AI into your projects and take them to the next level

https://github.com/dfinke/PowerShellAI

NimPlant

A light-weight first-stage C2 implant

https://github.com/chvancooten/NimPlant

serviceDetector

Detect whether a service is installed (blindly) and/or running (if exposing named pipes) on a remote machine via SMB without using local admin privileges.

https://github.com/tothi/serviceDetector

Split

Divide & Conquer approach to bypass EDRs

https://github.com/Kudaes/Split

ThreadlessInject-BOF

A novel process injection technique with no threat creation, released at BSides Cymru 2023

https://github.com/iilegacyyii/ThreadlessInject-BOF

ThreadlessInject

Threadless Process Injection using remote function hooking

https://github.com/CCob/ThreadlessInject

Cortex-XDR-Config-Extractor

Cortex XDR Agent (Database Lock Files) parser

https://github.com/Laokoon-SecurITy/Cortex-XDR-Config-Extractor

KeePwn

Python tool to automate KeePass discovery & secret exfiltration

https://github.com/Orange-Cyberdefense/KeePwn