cyberark / Evasor
Licence: apache-2.0
A tool to be used in post exploitation phase for blue and red teams to bypass APPLICATIONCONTROL policies
Stars: ✭ 134
Labels
Projects that are alternatives of or similar to Evasor
Byob
An open-source post-exploitation framework for students, researchers and developers.
Stars: ✭ 6,949 (+5085.82%)
Mutual labels: post-exploitation
Hacker Roadmap
📌 Your beginner pen-testing start guide. A guide for amateur pen testers and a collection of hacking tools, resources and references to practice ethical hacking and web security.
Stars: ✭ 7,752 (+5685.07%)
Mutual labels: post-exploitation
Ghost
Ghost Framework is an Android post-exploitation framework that exploits the Android Debug Bridge to remotely access an Android device. Ghost Framework gives you the power and convenience of remote Android device administration.
Stars: ✭ 992 (+640.3%)
Mutual labels: post-exploitation
Phpsploit
Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor
Stars: ✭ 1,188 (+786.57%)
Mutual labels: post-exploitation
Pyexfil
A Python Package for Data Exfiltration
Stars: ✭ 554 (+313.43%)
Mutual labels: post-exploitation
Bella
Bella is a pure python post-exploitation data mining tool & remote administration tool for macOS. 🍎💻
Stars: ✭ 112 (-16.42%)
Mutual labels: post-exploitation
Decryptrdcmanager
.NET 4.0 Remote Desktop Manager Password Gatherer
Stars: ✭ 59 (-55.97%)
Mutual labels: post-exploitation
Thoron
Thoron Framework is a Linux post-exploitation framework that exploits Linux TCP vulnerability to provide a shell-like connection. Thoron Framework has the ability to create simple payloads to provide Linux TCP attack.
Stars: ✭ 87 (-35.07%)
Mutual labels: post-exploitation
Fsociety
fsociety Hacking Tools Pack – A Penetration Testing Framework
Stars: ✭ 7,224 (+5291.04%)
Mutual labels: post-exploitation
Pxenum
A shell script that automatically performs a series of *NIX enumeration tasks.
Stars: ✭ 30 (-77.61%)
Mutual labels: post-exploitation
Pentesting toolkit
🏴☠️ Tools for pentesting, CTFs & wargames. 🏴☠️
Stars: ✭ 1,268 (+846.27%)
Mutual labels: post-exploitation
Pupy
Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool mainly written in python
Stars: ✭ 6,737 (+4927.61%)
Mutual labels: post-exploitation
Awesome Malware
💻⚠️ A curated collection of awesome malware, botnets, and other post-exploitation tools.
Stars: ✭ 108 (-19.4%)
Mutual labels: post-exploitation
Gtfonow
Automatic privilege escalation for misconfigured capabilities, sudo and suid binaries
Stars: ✭ 68 (-49.25%)
Mutual labels: post-exploitation
Silenttrinity
An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR
Stars: ✭ 1,767 (+1218.66%)
Mutual labels: post-exploitation
Postexploits
(windows) post exploitation: dll injection, process hollowing, RunPe, Keyloggers, UacByPass etc..
Stars: ✭ 111 (-17.16%)
Mutual labels: post-exploitation
Atomic Red Team Intelligence C2
ARTi-C2 is a post-exploitation framework used to execute Atomic Red Team test cases with rapid payload deployment and execution capabilities via .NET's DLR.
Stars: ✭ 87 (-35.07%)
Mutual labels: post-exploitation
Overview
The Evasor is an automated security assessment tool which locates existing executables on the Windows operating system that can be used to bypass any Application Control rules. It is very easy to use, quick, saves time and fully automated which generates for you a report including description, screenshots and mitigations suggestions, suites for both blue and red teams in the assessment of a post-exploitation phase.
Requirements
- Windows OS.
- Visual studio 2017 installed.
Usage instructions
Download the Evasor project and complie it. Verify to exclude from the project the App.config file from the reference tree.
run Evasor.exe from the bin folder. Choose your numeric option from the follwoing:
- Locating executable files that can be used to bypass the Application Control!
- Retrieving the all running processes relative paths
- Checking every process (executable file) if it vulnerable to DLL Injection by:
- Running “MavInject” Microsoft component from path C:\Windows\System32\mavinject.exe with default parameters.
- Checking the exit code of the MavInject execution, if the process exited normally it means that the process is vulnerable to DLL Injection and can be used to bypass the Application Control.
- Locating processes that vulnerable to DLL Hijacking!
- Retrieving the all running processes
- For each running Process:
- Retrieving the loaded process modules
- Checking if there is a permission to write data into the directory of the working process by creating an empty file with the name of the loaded module (DLL) or overwriting an existence module file on the working process directory.
- If the write operation succeeds – it seems that the process is vulnerable to DLL Hijacking.
- Locating for potential hijackable resource files
- Searching for specific files on the computer by their extension.
- Trying to replace that files to another place in order to validate that the file can be replaceable and finally, potentially vulnerable to Resource Hijacking.
- Extensions: xml,config,json,bat,cmd,ps1,vbs,ini,js,exe,dll,msi,yaml,lib,inf,reg,log,htm,hta,sys,rsp
- Generating an automatic assessment report word document includes a description of tests and screenshots taken.
Contributing
We welcome contributions of all kinds to this repository. For instructions on how to get started and descriptions of our development workflows, please see our contributing guide.
License
This repository is licensed under Apache License 2.0 - see LICENSE for more details.
Share Your Thoughts And Feedback
For more comments, suggestions or questions, you can contact Arik Kublanov from CyberArk Labs: Copyright © 2020 CyberArk Software Ltd. All rights reserved. Labs. You can find more projects developed by us in https://github.com/cyberark/.
Notes
- The original code developed and being used on CyberArk Labs: Copyright © 2020 CyberArk Software Ltd. All rights reserved. internaly, makes full automation and exploitation of the informative results.
- The original code contains part of activation and exploitation but we removed it from here.
- The files content under the DLLs folder are empty and not contains any exploitation code also and it's for the Cyber Security community Red and Blue teams to be used and to be implemented according to their own needs and can be a starting point for their assessment objectives.
Note that the project description data, including the texts, logos, images, and/or trademarks,
for each open source project belongs to its rightful owner.
If you wish to add or remove any projects, please contact us at [email protected].