Skip to content

README.md

Latest commit

 

History

History
39 lines (20 loc) · 1.18 KB

README.md

File metadata and controls

39 lines (20 loc) · 1.18 KB
Raw

WinAPI

A collection of scripts to learn and understand Defense Evasion with couple of techniques. These techniques aren't perfect and WILL be detected by AVs!(Educational only)

Contents

  • procinject.cpp
    A script which injects its code into a running Process.

  • dllinject.cpp
    A script which injects a DLL into a running Process via LoadLibraryA.

  • evildll.cpp
    PoC script which is used with dllinject.cpp as the DLL. (Before using you will need to compile this file into an DLL via g++. For troubleshooting see down below at Prerequisites

  • tokensteal.cpp
    A script which steals a token and impersonates an user with it.

Prerequisites

Note: Linux users typically have g++ pre-installed via apt install g++. This guide is for Windows users.

Windows: Install MinGW-w64 (via Chocolatey)

1.Download from the official chocolatey site at https://chocolatey.org

  1. Type this into your powershell/cmd: choco install mingw

  2. Refresh your shell with refreshenv

  3. Verify installation with g++ --version

For compiling use this command: g++ -shared -o evildll.dll evildll.cpp -static-libgcc -static-libstdc++