Sign in Join

Live chat for Free Pascal, Lazarus, Delphi and every Pascal programmer.

Catalog · How the catalog works

Random project

hypobrychium

Duplicate not owned Token from Running Process

View on GitHub

Anyone may press Interesting, signed in or not. It helps others find this project.

Member rating

No ratings yet.

Sign in to rate this project.

README

hypobrychium AV/EDR completely ignore me.

Duplicate (unowned) token from a running process without detections

Duplicate the token of a running process and run a command.

Use when there is a process on behalf of a domain administrator or to generate a CMD on any process.

When used with unowned process PIDs, there will be no screen input/output in the CMD, but the shell works fine.

The source will be published soon, I make it watchable ;-) It was written in Delphi (Lazarous)

Special thanks to Ewan who developed some highly professional units.

have fun

Required: Local administrator role

Examples in pics

image

image