Skip to content

Releases: diversenok/NtTools

InjectDLL v1.0

16 Apr 00:17
Compare
Choose a tag to compare

InjectDLL is a simple yet reliable DLL injector that understands process names and relative paths, prints the reasons for failures, prevents deadlocks, and works against Native, Win32, and WoW64 processes.

Under the hood, it uses a small shellcode that invokes LdrLoadDll on a remote thread and then forwards the result back to the caller,

Note:

  • The tool understands command-line parameters if they are supplied in the same order as when typing them interactively.

ChangeCurrentDir v1.0

16 Apr 01:10
Compare
Choose a tag to compare

ChangeCurrentDir allows changing the current directory of other processes. The tool supports Native, Win32, and WoW64 processes and understands process names and relative paths.

Under the hood, it reads the string from PEB and injects a remote thread to invoke RtlSetCurrentDirectory_U.

Note:

  • The tool understands command-line parameters if they are supplied in the same order as when typing them interactively.

RunAsS4U v2.0

15 Apr 23:34
Compare
Choose a tag to compare

RunAsS4U is a tool that allows administrators to start programs under other users without knowing their passwords. It can also dynamically grant or revoke administrative privileges to/from the processes it starts.

Changes:

  • Improve handling of privileges
  • Fix token owner when manually adding admin membership
  • Choose the command processor based on environment variables (i.e., %ComSpec%)

Note:

  • The tool understands command-line parameters if they are supplied in the same order as when typing them interactively.

RunAsS4U v1.0

15 Dec 18:57
Compare
Choose a tag to compare

RunAsS4U is a tool that allows administrators to start programs under other users without knowing their passwords. It can also dynamically grant or revoke administrative privileges to/from the processes it starts.