diff --git a/process_hollowing/README.md b/process_hollowing/README.md index f72e505..6ce5386 100644 --- a/process_hollowing/README.md +++ b/process_hollowing/README.md @@ -43,12 +43,13 @@ and change the shellcode to the shellcode generated in step 1

Linux

-[No features - 7 / 40](https://kleenscan.com/scan_result/455ff90547b103920f1c15ecf9c7189031828105db42541d7b4af1ec35c3351b) | [Using `--features xor` - 0 / 40](https://kleenscan.com/scan_result/bc54ab43e9eb41f529eb79416a54b29db3c8730b5b04964ac3cc7f7d4e5c8517) +[No features - 7 / 40](https://kleenscan.com/scan_result/1177abafe77dc580337ec6294c68bdc4873ceb36a4eeac057fd0673c3ae50e7f) | [Using `--features xor` - 0 / 40](https://kleenscan.com/scan_result/8a0268ca750a14fc93f40f6b1864f13ce94318c4c4a7ecc49dfeb332b9c9d860) :-------------------------:|:-------------------------: -![image](https://user-images.githubusercontent.com/14863147/152622612-63ff6018-7c51-46bf-ab39-b602d7deb2c9.png) | ![image](https://user-images.githubusercontent.com/14863147/152622626-5f66edf1-9e66-4ead-8014-42df0259c1ce.png) +![image](https://user-images.githubusercontent.com/14863147/164796610-611fa25b-a631-4f44-8e03-d80d0333dced.png) | ![image](https://user-images.githubusercontent.com/14863147/164796718-c37e8298-0a99-4b11-bcce-17638e31988a.png) +

Windows

-[No features - 13 / 40](https://kleenscan.com/scan_result/71843ced31794501973ee125c957a9c98b7194e6e47114aa6b3a22adf1dbf8b1) | [Using `--features xor` - 1 / 40](https://kleenscan.com/scan_result/78f3797dc160a38d75afec8c8ef98fe9f0221aef11089ca020d481df60028c21) | [Using `--features xor,antisand` - 0 / 40](https://kleenscan.com/scan_result/52369fcedfa0029ec43806ea3b6b74d3163cff5adc94e561faf4707bbe502c85) -:-------------------------:|:-------------------------:|:-------------------------: -![image](https://user-images.githubusercontent.com/14863147/152622727-917b3374-a951-4e13-805c-4face1aa00e9.png) | ![image](https://user-images.githubusercontent.com/14863147/152622738-85205628-10dd-4a19-849a-51139b0035f4.png) | ![image](https://user-images.githubusercontent.com/14863147/152622747-5a2492f8-aeb7-421a-b802-f694419e5720.png) +[No features - 12 / 40](https://kleenscan.com/scan_result/dd7858b48235bc782383fa5a929125369c7918d3c119a9196b0fdab791624763) | [Using `--features antisand` - 12 / 40](https://kleenscan.com/scan_result/dc73a322924b772b90957aaffe8d2735acd6d6049e0607a1befada2bc5aa86f3) | [Using `--features antistring` - 12 / 40](https://kleenscan.com/scan_result/1505ac5f33afe16a79796045d80c6c55617944c86396411487f1cbd934e875fb) | [Using `--features antisand,antistring` - 12 / 40](https://kleenscan.com/scan_result/177242f39b392107e4953a8cb717afbc6f912daa5bd9ec8d71a959834942db8d) | [Using `--features xor` - 6 / 40](https://kleenscan.com/scan_result/455d775c517cf26a6e83a42b3eae7982364d8a8174127eca377094c05e0dd948) | [Using `--features antistring,xor` - 1 / 40](https://kleenscan.com/scan_result/e6214cb0175737d1e3bba8bafbaa17d5aa575f613dab718a6d35dd46c7af8767) | [Using `--features antisand,xor` - 0 / 40](https://kleenscan.com/scan_result/de899245ec6a258d741b6243d18cf10fae5e6a1fe344ab3d02f17899a67d2bb7) | [Using `--features antisand,antistring,xor` - 0 / 40](https://kleenscan.com/scan_result/49f53e2e15b86d9e5425d684e9ab964289d2d96fef8ca61ba927e3826ebd0392) +:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------: +![image](https://user-images.githubusercontent.com/14863147/164800253-42ae28de-dded-4d81-98b5-8169372247de.png) | ![image](https://user-images.githubusercontent.com/14863147/164803213-b5320794-8e57-4552-ab67-2358ffdd5a81.png) | ![image](https://user-images.githubusercontent.com/14863147/164803228-2ef5ddb5-cfee-4a98-8cad-c2a2c0aec4f9.png) | ![image](https://user-images.githubusercontent.com/14863147/164803261-073277a8-af2d-4a77-bf6d-7c3ea25bc663.png) | ![image](https://user-images.githubusercontent.com/14863147/164803307-97d7b75c-4c79-4699-a36c-d99923789751.png) | ![image](https://user-images.githubusercontent.com/14863147/164803332-2d97dd6b-7c78-4b9b-9a14-62430ea83f06.png) | ![image](https://user-images.githubusercontent.com/14863147/164803356-4e45da59-b6bb-4432-89c9-cc91cf1b895e.png) | ![image](https://user-images.githubusercontent.com/14863147/164803373-2cd49344-b5bb-48c1-b853-a7c893435f73.png) diff --git a/process_migration/README.md b/process_migration/README.md index 2b84c6c..155b577 100644 --- a/process_migration/README.md +++ b/process_migration/README.md @@ -44,12 +44,13 @@ and change the shellcode to the shellcode generated in step 1

Linux

-[No features: 7 / 40](https://kleenscan.com/scan_result/3eb81783f8424844677211df497e521613ee5b0b82a5996f96a63b941ba3c87e) | [Using `--features xor`: 0 / 40](https://kleenscan.com/scan_result/b9c0d8a42da33d14be8422bd087624e548a6ecdd22c1d25aed06873e28d1dd96) +[No features: 7 / 40](https://kleenscan.com/scan_result/5d88b167a6fdf674a0a81514e37f171a4d0eb63c0b063dec1dd02a5d9b63d4fb) | [Using `--features xor`: 0 / 40](https://kleenscan.com/scan_result/5568475e28d65306af33f75df28e215e7024daa922241fbd9c1e9205cd27a96d) :-------------------------:|:-------------------------: -![image](https://user-images.githubusercontent.com/14863147/152621843-b78927d0-cfeb-40d0-b150-15d332b0fd61.png) | ![image](https://user-images.githubusercontent.com/14863147/152621872-4be9e051-f9c4-4ecb-bd3d-dcc58980e061.png) +![image](https://user-images.githubusercontent.com/14863147/164811534-e6234f39-8aa4-4e66-b5fa-4af14721ae17.png) | ![image](https://user-images.githubusercontent.com/14863147/164811826-de37a797-2e41-4856-a3dd-db02e3b677ad.png) +

Windows

-[No features: 13 / 40](https://kleenscan.com/scan_result/f7c2b651b9629421550a380c09c7b9739d806a62db6fd9d571164b3f5df6a5b9) | [Using `--features xor`: 1 / 40](https://kleenscan.com/scan_result/ac4a1184e97abf31ebd968d2455535b92be646af54d077cbdb3b0a24254aae78) | [Using `--features xor,antisand`: 0 / 40](https://kleenscan.com/scan_result/f7e459f40276d8d1d12bb738b3aaf972997b8275da00967d8dbc264993ed5dc8) -:-------------------------:|:-------------------------:|:-------------------------: -![image](https://user-images.githubusercontent.com/14863147/152622089-0e41fc02-9c17-4017-882a-26b58d6166c5.png) | ![image](https://user-images.githubusercontent.com/14863147/152622105-268df42f-b240-463b-baf0-3df350e77110.png) | ![image](https://user-images.githubusercontent.com/14863147/152622122-3705c608-62b5-4650-8d79-a7ad128c7a9d.png) +[No features: 12 / 40](https://kleenscan.com/scan_result/5588bdf5da5bd1c25e08ca6cb7a07d7729160a5fdcbc218b8f7cd112620f6f67) | [Using `--features antisand`: 12 / 40](https://kleenscan.com/scan_result/ebebddfa24b6d95c65900003629914cbcadf09fddcd9a70db614b9f8e9f5fc42) | [Using `--features antistring`: 12 / 40](https://kleenscan.com/scan_result/7200bae53ce50bd8b0f3a528026ee72d71b47615235cf96384fe0752a1ff6145) | [Using `--features antisand,antistring`: 12 / 40](https://kleenscan.com/scan_result/e702816970ee629f718e6dbec58a129b03742b0ac7644bc3de942d8368e7252b) | [Using `--features xor`: 1 / 40](https://kleenscan.com/scan_result/8b3feb5f4db1b06a9fd33a9597b62d22847f518f607d7f049579b87b44ce8fea) | [Using `--features antistring,xor`: 1 / 40](https://kleenscan.com/scan_result/f580330422109325f3c83fd1fa51a966798cb173d0edca5c1b4c310a2c95c082) | [Using `--features antisand,xor`: 0 / 40](https://kleenscan.com/scan_result/19a7640ebedb91c375aeebf9d576ea005260610ca0eb23621413dc058a8ff067) | [Using `--features antisand,antistring,xor`: 0 / 40](https://kleenscan.com/scan_result/1de23cfca021214907bb51174df2b8d69d2fe45cb6ebc903c1e3328bb958678f) +:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------: +![image](https://user-images.githubusercontent.com/14863147/164814085-63e17b83-8136-45f3-8e86-9a0e56b60d25.png) | ![image](https://user-images.githubusercontent.com/14863147/164814102-137956c9-aff4-449c-95ff-e3f82be0d057.png) | ![image](https://user-images.githubusercontent.com/14863147/164814134-1fb427ae-f112-458c-9e76-b9c637fa1afb.png) | ![image](https://user-images.githubusercontent.com/14863147/164814162-16f2c0f6-2444-46e4-90a0-42549ef5adac.png) | ![image](https://user-images.githubusercontent.com/14863147/164814200-83ead2dc-6ab6-4401-873f-f7c6d43ddfcd.png) | ![image](https://user-images.githubusercontent.com/14863147/164814265-66705820-2fe6-49d8-af8b-9be17871a925.png) | ![image](https://user-images.githubusercontent.com/14863147/164814286-70ad83a9-56e1-40c0-b4c4-211887361507.png) | ![image](https://user-images.githubusercontent.com/14863147/164814306-c8ebceac-c685-4e24-9ea9-548fbc84c43c.png) diff --git a/tcp_reverse_shell/README.md b/tcp_reverse_shell/README.md index 90e0217..7613056 100644 --- a/tcp_reverse_shell/README.md +++ b/tcp_reverse_shell/README.md @@ -37,7 +37,15 @@ and change the IP address and port to match the IP address of your attacking mac ## Detection rates -[Linux - 0 / 40](https://kleenscan.com/scan_result/797f4631dd2cbe2251507376b0d091e86478866b02b2a6718cc26c959a0139b9) | [Windows - 0 / 40](https://kleenscan.com/scan_result/64c9cd080360dc668126cd89aeff1ca40a44359dea9a075064f1ac1e0cc3b27f) -:-------------------------:|:-------------------------: -![image](https://user-images.githubusercontent.com/14863147/152621667-d230aa8d-24e6-435b-8ff9-bab59a346ddc.png) | ![image](https://user-images.githubusercontent.com/14863147/152621688-dae58eef-1688-4c8e-a5a9-7f6d21dcc1a0.png) +

Linux

+[No features: 0 / 40](https://kleenscan.com/scan_result/c01984f5bc45f0ff82723fe6ceab770fe48e955081f8b02e17a8232e6ba2bbeb) +:-------------------------: +![image](https://user-images.githubusercontent.com/14863147/164814492-64a4c3e7-e736-4bee-9baa-87d9d49b417b.png) + + +

Windows

+ +[No features: 0 / 40](https://kleenscan.com/scan_result/ce74ac206b59e9acc4e7f528bcec06f2a1dcc8ac0a1fb622c0b646cdfd2602d5) | [Using `--features antisand`: 0 / 40](https://kleenscan.com/scan_result/28fce6da1a75b3d0073649613d5e69b73019091e1a7c2a2033b1551755c5fad4) | [Using `--features antistring`: 0 / 40](https://kleenscan.com/scan_result/fafcad9c3689cf811184cacc3c1e9f939017b4e5d362712468839a6126f82278) | [Using `--features antisand,antistring`: 0 / 40](https://kleenscan.com/scan_result/ff8c1a3fda94bd5f73314e15c9861284250b88720f045351aedc937435b9d8bd) +:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------: +![image](https://user-images.githubusercontent.com/14863147/164814640-1355d414-087b-48c0-9067-2ab6f2ad12bf.png) | ![image](https://user-images.githubusercontent.com/14863147/164814649-9f3ccebd-427e-432f-adcf-06cab5b37c45.png) | ![image](https://user-images.githubusercontent.com/14863147/164814643-a32b5580-c6f0-4ff4-ba44-9c71b408f386.png) | ![image](https://user-images.githubusercontent.com/14863147/164814653-4d6dfe0c-a0b2-44ef-b513-920b8a5530e1.png)