In the ever-evolving landscape of cybersecurity threats, one campaign has recently caught the attention of McAfee Labs. This sophisticated VBS script-driven campaign employs obfuscated Visual Basic Scripting (VBS) to deliver a range of malware,...
PoolParty A collection of fully-undetectable process injection techniques abusing Windows Thread Pools. Presented at Black Hat EU 2023 Briefings under the title – The Pool Party You Will Never Forget: New Process Injection Techniques Using...
Process Stomping A variation of ProcessOverwriting to execute shellcode on an executable’s section What is it Process Stomping, is a variation of hasherezade’s Process Overwriting and it has the advantage of writing a shellcode payload on...
Shelltropy A technique of hiding malicious shellcode based on low-entropy via Shannon encoding. Entropy is the measure of the randomness in a set of data (here: shellcode). The higher the entropy, the more random...
BlobRunner is a simple tool to quickly debug shellcode extracted during malware analysis. It allocates memory for the target file and jumps to the base (or offset) of the allocated memory. This allows an...
Shellen Shellen is an interactive shellcoding environment. If you want a handy tool to write shellcodes, then shellen may be your friend. Also, it can be used just as assembly/disassembly tool. It uses keystone and capstone engines for...
“Pop Nedry” x86-64 Payload Why pop calc, when you can pop Nedry!? This repository contains an x86-64 payload that recreates the Jurassic Park scene in which Dennis Nedry locks Ray Arnold out of his...
fido Teaching an old shellcode new tricks Give fido.py a x86 (32 bit or 64 bit) windows shellcode and it will strip off Stephen Fewer’s hash API stub and replace it with something that...
Secure Your Connection
