753c33686578 Goto Github PK

amsiscanbufferbypass

Circumvent AMSI by patching AmsiScanBuffer

assemblyloader

Loads .NET Assembly Via CLR Loader

bof-networkserviceescalate

Abuses the Shared Logon Session ID Issue (Described [here](https://www.tiraniddo.dev/2020/04/sharing-logon-session-little-too-much.html) by the awesome James Forshaw) To Achieve System From NetworkService. Can be used as a "getsystem" as well

building-c2-implants-in-cpp

The source code files that accompany the short book "Building C2 Implants in C++: A Primer" by Steven Patterson (@shogunlab).

cs-rdll-ipc-example

Example code for using named pipe output with beacon ReflectiveDLLs

defcon-25-workshop

Windows Post-Exploitation / Malware Forward Engineering DEF CON 25 Workshop

dll-hijack-by-proxying

Exploiting DLL Hijacking by DLL Proxying Super Easily

dnscat2

ghostloader

GhostLoader - AppDomainManager - Injection - 攻壳机动队

malleable-c2

Cobalt Strike Malleable C2 Design and Reference Guide

mallory

Mallory - MiTM TCP and UDP Proxy

malware-analysis-training

Retired beginner/intermediate malware analysis training materials from @pedramamini and @erocarrera.

mcfridafee

misc-powershell-scripts

Random Tools

mkhtaccess_red

Auto-generate an HTaccess for payload delivery -- automatically pulls ips/nets/etc from known sandbox companies/sources that have been seen before, and redirects them to a benign payload.

msbuildapicaller

MSBuild Without MSBuild.exe

net-gpppassword

.NET implementation of Get-GPPPassword. Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.

peloader

Load PE via XML Attribute

pentesting-bible

This repository was created and developed by Ammar Amer @cry__pto Only. Updates to this repository will continue to arrive until the number of links reaches 10000 links & 10000 pdf files .Learn Ethical Hacking and penetration testing .hundreds of ethical hacking & penetration testing & red team & cyber security & computer science resources.

powersploit

PowerSploit - A PowerShell Post-Exploitation Framework

process-hollowing

Great explanation of Process Hollowing (a Technique often used in Malware)

random-csharptools

Collection of CSharp Assemblies focused on Post-Exploitation Capabilities

redshell

An interactive command prompt for red teaming and pentesting. Pushes commands through proxychains via Cobalt Strike beacon socks proxies or custom proxies. Automatically logs activities on a Cobalt Strike teamserver and/or local files.

sandbox-attacksurface-analysis-tools

Set of tools to analyze and attack Windows sandboxes.

srdi

Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

stardust

A modern 64-bit position independent implant template

subtee-gits-backups

subTee gists code backups

suspending-techniques

Comparing, discussing, and bypassing various techniques for suspending and freezing processes on Windows.

threadcontinue

Reflective DLL injection using SetThreadContext() and NtContinue()

trigen

Trigen is a Python script which uses different combinations of Win32 function calls in generated VBA to execute shellcode.