Bypassing31 Living off the Process
The article “Living off the Process” details a technique to inject and execute shellcode into a remote Windows process by reusing existing…
oxfemale·
Feb 23·
30 min
·31
// shellcode
18 postsBypassing31 
Bypassing18 Writing Optimized Windows Shellcode (old but gold)
A deep dive into crafting ultra-compact Windows shellcode that walks the PEB, resolves APIs via export hashing, and runs fully self-contained without…
oxfemale·
Feb 13·
19 min
·18
APC24 EarlyBird APC Injection: A Deep Technical Analysis
The EarlyBird APC technique creates a trusted process in a suspended state, allocates memory for shellcode, and writes the payload. It then…
oxfemale·
Feb 13·
6 min
·24
Process Injection via Component Object Model (COM) IRundown::DoCallback() for run cmd.exe from lsass.exe or other pids
A PoC/demo demonstrating code injection via COM (using the IRundown::DoCallback() mechanism) to execute a payload in the context of a selected process, including lsass.exe (or any…
oxfemale·
Feb 6·
1 min
·33
Bypassing15 Abusing Microsoft Warbird for Shellcode Execution
The article demonstrates an EDR bypass by using an undocumented Warbird interface to stealthily load shellcode.
oxfemale·
Feb 4·
15 min
·15
ASM41 Mastering Living off the Process in Offensive Security
No need for overusing WriteProcessMemory, VirtualAlloc, injecting a DLL, etc. This way, everything you need to manipulate the remote process is self-contained…
oxfemale·
Feb 2·
30 min
·41