Home Explore Help
Sign In
zhensolid
/
OperatorsKit
1
0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Tree: 263c81c60d
Branches Tags
OperatorsKit
/
KIT
/
FindRWX
unknown 263c81c60d small fix 2 years ago
..
README.md 127205db02 Update README.md 2 years ago
beacon.h db89d9b285 first commit 2 years ago
bofcompile.bat db89d9b285 first commit 2 years ago
findrwx.c 66368f4738 small cleanup 2 years ago
findrwx.cna 263c81c60d small fix 2 years ago
findrwx.h db89d9b285 first commit 2 years ago
findrwx.o bf580750a5 update 2 years ago

README.md

FindRWX

Find processes that already have memory allocated for read/write/execute (like most .NET processes).

Options

  • <pid>: specify target process ID to enumerate.

Usage

  • findrwx <pid>

Compile

  • 1. Make sure Visual Studio is installed and supports C/C++.
  • 2. Open the x64 Native Tools Command Prompt for VS <2019/2022> terminal.
  • 3. Run the bofcompile.bat script to compile the object file.
  • 4. In Cobalt strike, use the script manager to load the .cna script to import the tool.