All Projects → EgeBalci → IAT_API

EgeBalci / IAT_API

Licence: MIT license
Assembly block for finding and calling the windows API functions inside import address table(IAT) of the running PE file.

Programming Languages

assembly
5116 projects
python
139335 projects - #7 most used programming language

Projects that are alternatives of or similar to IAT API

Defeat-Defender-V1.2
Powerful batch script to dismantle complete windows defender protection and even bypass tamper protection ..Disable Windows-Defender Permanently....Hack windows. POC
Stars: ✭ 885 (+1304.76%)
Mutual labels:  malware, antivirus, bypass
Hacktheworld
An Python Script For Generating Payloads that Bypasses All Antivirus so far .
Stars: ✭ 527 (+736.51%)
Mutual labels:  malware, antivirus, bypass
Thefatrat
Thefatrat a massive exploiting tool : Easy tool to generate backdoor and easy tool to post exploitation attack like browser attack and etc . This tool compiles a malware with popular payload and then the compiled malware can be execute on windows, android, mac . The malware that created with this tool also have an ability to bypass most AV softw…
Stars: ✭ 5,944 (+9334.92%)
Mutual labels:  malware, antivirus, bypass
Antimalware Research
Research on Anti-malware and other related security solutions
Stars: ✭ 163 (+158.73%)
Mutual labels:  exploit, antivirus, bypass
JustEvadeBro
JustEvadeBro, a cheat sheet which will aid you through AMSI/AV evasion & bypasses.
Stars: ✭ 63 (+0%)
Mutual labels:  malware, antivirus, bypass
Php Antimalware Scanner
AMWScan (PHP Antimalware Scanner) is a free tool to scan php files and analyze your project to find any malicious code inside it.
Stars: ✭ 181 (+187.3%)
Mutual labels:  exploit, malware, antivirus
Green Hat Suite
Green-hat-suite is a tool to generate meterpreter/shell which could evade antivirus.
Stars: ✭ 112 (+77.78%)
Mutual labels:  malware, antivirus
Ergo Pe Av
🧠 🦠 An artificial neural network and API to detect Windows malware, based on Ergo and LIEF.
Stars: ✭ 130 (+106.35%)
Mutual labels:  malware, antivirus
getroot
🛠️ Tool to bypass my school's security system to get sudo privileges on MacOS
Stars: ✭ 34 (-46.03%)
Mutual labels:  exploit, bypass
Penetration testing poc
渗透测试有关的POC、EXP、脚本、提权、小工具等---About penetration-testing python-script poc getshell csrf xss cms php-getshell domainmod-xss penetration-testing-poc csrf-webshell cobub-razor cve rce sql sql-poc poc-exp bypass oa-getshell cve-cms
Stars: ✭ 3,858 (+6023.81%)
Mutual labels:  exploit, bypass
MalwareDatabase
One of the few malware collection
Stars: ✭ 37 (-41.27%)
Mutual labels:  exploit, malware
windows-defender
Malice Windows Defender AntiVirus Plugin
Stars: ✭ 31 (-50.79%)
Mutual labels:  malware, antivirus
Malice
VirusTotal Wanna Be - Now with 100% more Hipster
Stars: ✭ 1,253 (+1888.89%)
Mutual labels:  malware, antivirus
Php Malware Finder
Detect potentially malicious PHP files
Stars: ✭ 1,245 (+1876.19%)
Mutual labels:  malware, antivirus
Kicomav
KicomAV is an open source (GPL v2) antivirus engine designed for detecting malware and disinfecting it.
Stars: ✭ 227 (+260.32%)
Mutual labels:  malware, antivirus
HatVenom
HatVenom is a HatSploit native powerful payload generation tool that provides support for all common platforms and architectures.
Stars: ✭ 84 (+33.33%)
Mutual labels:  exploit, malware
Php imap open exploit
Bypassing disabled exec functions in PHP (c) CRLF
Stars: ✭ 392 (+522.22%)
Mutual labels:  exploit, bypass
K8tools
K8工具合集(内网渗透/提权工具/远程溢出/漏洞利用/扫描工具/密码破解/免杀工具/Exploit/APT/0day/Shellcode/Payload/priviledge/BypassUAC/OverFlow/WebShell/PenTest) Web GetShell Exploit(Struts2/Zimbra/Weblogic/Tomcat/Apache/Jboss/DotNetNuke/zabbix)
Stars: ✭ 4,173 (+6523.81%)
Mutual labels:  exploit, bypass
Herpaderping
Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the intentions of a process.
Stars: ✭ 614 (+874.6%)
Mutual labels:  exploit, antivirus
Phpmussel
PHP-based anti-virus anti-trojan anti-malware solution.
Stars: ✭ 337 (+434.92%)
Mutual labels:  malware, antivirus

IAT API

Assembly block for finding and calling the windows API functions inside import address table(IAT) of the running PE file.

Design of the block is inspired by Stephen Fewer's block_api and Josh Pitts's 2017 DEFCON talk. iat_api finds the addresses of API functions by parsing the _IMAGE_IMPORT_DESCRIPTOR structure entries inside the import table of the PE file. It uses the CRC32 calculation routine from CRC32_API and calculates the CRC32(polynomial 11EDC6F41H) value of the (module name + function name) and compares with the value passed to block. If the value matches it calls the function with the parameters passed to block.

Description

One of the main objectives while designing iat_api was bypassing exploit mitigation techniques used inside EMET, Windows Defender and similar security products. Using import address table(IAT) entries instead of export address table(EAT) makes it possible to find API addresses without reading the KERNEL32/NTDLL and KERNELBASE therefore bypasses the EMET's Export Address Filtering(EAF) and Export Address Filtering Plus(EAF+) mitigations. Also after finding the wanted API addresses iat_api makes a CALL to the API instead of jumping or returning inside it therefore bypasses EMET's caller checks. Changing the rotation value used for calculating the function name hash may help bypassing anti virus products that are using ROR13 hashes as signature detection.

IMPORTANT !!

  • The function that is called with iat_api must be imported by the PE file or it will crash.

Example

Here is a example MessageBox shellcode using the iat_api.

Description

Here is a 64 bit example MessageBox shellcode using the iat_api.

Description

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].