Pinned Loading

1. LibTP_Gadget LibTP_Gadget Public

   Forked from rasta-mouse/LibTP

   Crystal Palace library for proxying Nt API calls via the Threadpool. Updated for call gadgets.

   C 15 3

2. AlmondOffSec/LibTPLoadLib AlmondOffSec/LibTPLoadLib Public

   Using call gadgets to break the call stack signature used by Elastic on proxying a module load. Provided as a Crystal Palace shared library. Format inspired by @rasta-mouse's LibTP.

   C 69 6

3. AlmondOffSec/DCOMRunAs AlmondOffSec/DCOMRunAs Public

   Lateral movement with DCOM DLL hijacking

   C 173 23

4. HookDetector HookDetector Public

   HookDetector identifies DLL-imported functions that have been hooked in its own process.

   C 1

5. regdiff.py regdiff.py Public

   regdiff.py diffs two registry hives

   Python

6. Get-ModifiablePathFromProcmon Get-ModifiablePathFromProcmon Public

   A simple PowerShell function parsing a Procmon CSV output to extract accessed filesystem and registry paths and using @itm4n's PrivescCheck's functions `Get-ModifiablePath` and `Get-ModifiableRegis…

   PowerShell 1