ulexecve
PythonMemoryModule
Our great sponsors
ulexecve | PythonMemoryModule | |
---|---|---|
2 | 4 | |
169 | 277 | |
1.2% | - | |
5.2 | 4.9 | |
4 months ago | 4 months ago | |
Python | Python | |
BSD 3-clause "New" or "Revised" License | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
ulexecve
-
Can I exec an new process without an executable file? (2015)
Definitely tricky. I solved it with a Python implementation by building up a big jumpbuffer so that the moment I leave Python-land I copy from temporary buffers to the right addresses and then ultimately jump at the entry point of the newly loaded binary. It's tricky and took quite some debugging to get right, but it's proven rather solid now.
See https://github.com/anvilsecure/ulexecve/blob/main/ulexecve.p... for details. Especially the `CodeGenerator` classes with implementations in x86, x86-64 and aarch64.
PythonMemoryModule
What are some alternatives?
Pyramid - a tool to help operate in EDRs' blind spots
gmailc2 - A Fully Undetectable C2 Server That Communicates Via Google SMTP to evade Antivirus Protections and Network Traffic Restrictions
systemd-user-sleep - Activate a user sleep target when the system sleeps
Metadata-Remover - A simple Metadata Removal Tool for images and videos using exiftool and ffmpeg in C and Python3.
HavocNotion - A simple ExternalC2 POC for Havoc C2. Communicates over Notion using a custom python agent, handler and extc2 channel. Not operationally safe or stable, built as a PoC to showcase Havoc C2's modular C2 channel interface.
byob - An open-source post-exploitation framework for students, researchers and developers.
mmLoader - A library for loading dll module bypassing windows PE loader from memory (x86/x64)