credteam Goto Github PK

hev-socks5-server

A simple, lightweight socks5 server for Unix (Linux/BSD/macOS)

hev-socks5-tproxy

A simple, lightweight socks5 transparent proxy for Linux. (IPv4/IPv6/TCP/UDP over TCP)

hev-socks5-tunnel

Tunnel over Socks5 proxy (tun2socks) (IPv4/IPv6/TCP/UDP over TCP)

hollow

EarlyBird process hollowing technique (BOF) - Spawns a process in a suspended state, inject shellcode, hijack main thread with APC, and execute shellcode

hookdump

Security product hook detection

impacket

Impacket is a collection of Python classes for working with network protocols.

injectamsibypass

Cobalt Strike BOF - Bypass AMSI in a remote process with code injection.

injectetwbypass

CobaltStrike BOF - Inject ETW Bypass into Remote Process via Syscalls (HellsGate|HalosGate)

ioctlpus

juicy-potato

A sugared version of RottenPotatoNG, with a bit of juice, i.e. another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM.

kerberoast

kernel-dev

Random code snippets related to kernel code development

koadic

Koadic C3 COM Command & Control - JScript RAT

link

link is a command and control framework written in rust

lockdexedemo

A demo of the relevant blog post: https://www.arashparsa.com/hook-heaps-and-live-free/

lsassy

Extract credentials from lsass remotely

malleable-c2-profiles

Malleable C2 is a domain specific language to redefine indicators in Beacon's communication. This repository is a collection of Malleable C2 profiles that you may use. These profiles work with Cobalt Strike 3.x.

malleable-c2-profiles-1

Cobalt Strike - Malleable C2 Profiles. A collection of profiles used in different projects using Cobalt Strike https://www.cobaltstrike.com/.

metasploit-loader

A client compatible with Metasploit's staging protocol

minhook

The Minimalistic x86/x64 API Hooking Library for Windows

misc-powershell-scripts

Random Tools

misctools

Miscellaneous Tools

mminject

Kernel DLL Injector using NX Bit Swapping and VAD hide for hiding injected DLL

netntlm

A crappy hook on SpAcceptLsaModeContext that prints incoming auth attempts. WIP

ninja_uuid_runner

Module Stomping, No New Thread, HellsGate syscaller, UUID Shellcode Runner for x64 Windows 10!

nobelium-pdfdlrunaesshellcode

A recreation of the "Nobelium" malware based on Microsofts Malware analysis - Part 1: PDF2Pwn

ntdllunpatcher

Example code for EDR bypassing

nuages

A modular C2 framework

osint-map

🗺 A map of OSINT tools.

pezor

Open-Source Shellcode & PE Packer