zha0 / win32api-practice Goto Github PK

List

• JuicyPotato WebShell version, modified from juicy-potato
• PrintSpoofer WebShell version, modified from PrintSpoofer
• PrintSpoofer Reflective DLL version, via ReflectiveDLLInjection
• WMIExec - invoke WMI - Win32_Process::Create to execute command on remote machine
• KeyLogger - keyboard logger via Windows message hook
• ArgumentSpoofer - spoof command line parameters, like argue command in CobaltStrike (version >= 3.13)
• OXIDNicResolver - use native API to retrieve nic's network address from remote machine via RPC/135 without authentication
• procdump - dump full(type 0x02) process memory via MiniDumpWriteDump(unhook if necessary)
• dump-lsass-via-rpc-addssp - code from xpn, use AddSecurityPackage RPC call to add(inject) SSP DLL
• DllHijackDigger - dig runtime dynamic linking DLL hijack automatically