Ｓｅｃ Ｎｏｔｅ

X64 Deep Dive
(Good For your Ideas)

movfuscator

#Obf

1. ThreadStackSpoofer by mgeeky

Overview: This tool demonstrates an advanced in-memory evasion technique that spoofs the thread call stack. It's designed to bypass thread-based memory examination rules, making it harder for analysts to detect injected shellcode within process memory.

- [ThreadStackSpoofer GitHub Repository]


2. CallStackSpoofer by WithSecureLabs

Overview: This proof-of-concept implementation demonstrates how to spoof arbitrary call stacks during system calls, such as NtOpenProcess. It's a more advanced technique that builds upon the concepts introduced in ThreadStackSpoofer.

- [CallStackSpoofer GitHub Repository]


3. Draugr by NtDallas

Overview: Draugr is a Cobalt Strike Beacon
Object File (BOF) template that facilitates the creation of synthetic stack frames, effectively spoofing the call stack during execution. It utilizes gadgets from KERNELBASE.DLL to achieve this

- [Draugr GitHub Repository]


4. LoudSunRun by susMdT

Overview: LoudSunRun is a technique that involves stack spoofing with synthetic frames. It calculates the total stack size of fake frames and adjusts stack arguments accordingly to obscure the true execution path.

- [LoudSunRun GitHub Repository]


5. BokuLoader by boku7

Overview: BokuLoader is a proof-of-concept Cobalt Strike Reflective Loader that aims to recreate, integrate, and enhance Cobalt Strike's evasion features. It combines various evasion techniques, including call stack spoofing, to achieve stealthy execution.

- [BokuLoader GitHub Repository]


https://dtsec.us/2023-09-15-StackSpoofin/

#Loader #callstack

WSASS

This is a tool that uses the old WerfaultSecure.exe program to dump the memory of processes protected by PPL (Protected Process Light), such as LSASS.EXE. The output is in Windows MINIDUMP format.

#lsass

Metamorphic cross-compilation of C++ & C-code to PIC, BOF & EXE.

#maldev

The video shows 11 members of the Conti ransomware gang.

Dubai, UAE, February 2022

#GangExposed #Conti #Ransomware

DotnetNoVirtualProtectShellcodeLoader
load shellcode without P/D Invoke and VirtualProtect call.

How
This code leverages built-in .NET functionality to allocate an RWX memory region and overwrite a C# method with your own shellcode using the RuntimeHelpers.PrepareMethod(handle) method.

https://github.com/Mr-Un1k0d3r/DotnetNoVirtualProtectShellcodeLoader

https://g3tsyst3m.github.io/uac%20bypass/Bypass-UAC-via-Intel-ShaderCache/

https://cicada-8.medium.com/were-going-the-wrong-way-how-to-abuse-symlinks-and-get-lpe-in-windows-0c598b99125b

https://specterops.io/blog/2025/06/18/administrator-protection/

https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e

#uac

VAC-Module-Dumper

Ever Wondered how an anti-cheat system is actually loaded into memory?

Aspasia - Counter-Strike 2 Reverse Engineering Framework


#gh #csgo

Chasing the Silver Fox: https://research.checkpoint.com/2025/silver-fox-apt-vulnerable-drivers


Vuln_ #driver

Cross-Session DCOM-Relay attack

Relaying Potatoes: Another Unexpected Privilege Escalation Vulnerability in Windows RPC Protocol

BlueHat IL 2022 - Antonio Cocomazzi & Andrea Pierini - Relaying to Greatness

Windows Exploitation Tricks: Relaying DCOM Authentication by jams forshaw


HTB machine to see how it is in real example:
https://www.0xfr3nzy.com/posts/htb-shibuya-windows-hard/

#HTB

✨ Driver Mapping: Injecting Code into Kernel Mode

Breaking ADCS: ESC1 to ESC16 Attack Techniques

#AD

Также небольшое пояснение к коду.

White Matter. Vol 1. You Are (Not) Alone

Важный дисклеймер: Этот инструмент предназначен исключительно для образовательных целей и тестирования на системах, где у вас есть явное разрешение. Не используйте его для незаконного доступа к системам.
Автор инструмента не несет ответственности за ваши действия.

В этой части релиза я создал инструмент и бэкдор в одном лице, позволяющий взламывать SSH сервера и обычные системы со статическим IP-адресом, закрепляться в этих системах, перехватывать нажатия клавиш удаленно с помощью кейлоггера и прочие интересные возможности.

Ссылка на репо: https://github.com/lain0xff/White-Matter

#malware #offensive #white_matter

ChromElevator

Fully decrypt App-Bound Encrypted (ABE) cookies, passwords & payment methods from Chromium-based browsers (Chrome, Brave, Edge) - all in user mode, no admin rights required.

🕷 #stealer

sory this not pass

VMProtect Ultimate Build 3.8.7.2001 crack

https://www.virustotal.com/gui/file/902aa0a1ef80e0f7cabdbfbed01f2e9f39923c0ac4c57cf0343cbf1c934f093a?nocache=1

the file is not mine, run it strictly at your discretion on a virtual machine. I ran it, and everything worked as it should.