fnsank Goto Github PK

cs2modrewrite

Convert Cobalt Strike profiles to modrewrite scripts

ctl

The C Template Library

cve-2021-1732-exploit

CVE-2021-1732 Exploit

defaultcreds-cheat-sheet

One place for all the default credentials to assist the Blue/Red teamers activities on finding devices with default password 🛡️

detectcobaltstomp

Detects Module Stomping as implemented by Cobalt Strike

detoursnt

Detours with just single dependency - NTDLL

dinvoke

Dynamically invoke arbitrary unmanaged code from managed code without PInvoke.

dinvokeprocesshollowing

dionaea

Home of the dionaea honeypot

donut

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters

doppelgate

DoppelGate relies on reading ntdll on disk to grab syscall stubs, and patches these syscall stubs into desired functions to bypass Userland Hooking.

dotnetexp

dotnettojscript

A tool to create a JScript file which loads a .NET v2 assembly from memory.

edrs

elevatekit

The Elevate Kit demonstrates how to use third-party privilege escalation attacks with Cobalt Strike's Beacon payload.

entropyreducer

Reduce Entropy And Obfuscate Youre Payload With Serialized Linked Lists

erebus

CobaltStrike后渗透测试插件

etwconsumernt

Simple project that demonstrates how an ETW consumer can be created just by using NTDLL

evasor

A tool to be used in post exploitation phase for blue and red teams to bypass APPLICATIONCONTROL policies

evilclippy

A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.

evilselenium

EvilSelenium is a tool that weaponizes Selenium to attack Chromium based browsers.

evtx-attack-samples

Windows Events Attack Samples

executeassembly

Load/Inject .NET assemblies by; reusing the host (spawnto) process loaded CLR AppDomainManager, Stomping Loader/.NET assembly PE DOS headers, Unlinking .NET related modules, bypassing ETW+AMSI, avoiding EDR hooks via NT static syscalls (x64) and hiding imports by dynamically resolving APIs (hash).

extremedumper

.NET Assembly Dumper

fermion

Fermion, an electron wrapper for Frida & Monaco.

funcinevasiontechniquedemo

ghostbuild

GhostBuild is a collection of simple MSBuild launchers for various GhostPack/.NET projects

gpuzmaper

using gpuz to load driver

greatsct

The project is called Great SCT (Great Scott). Great SCT is an open source project to generate application white list bypasses. This tool is intended for BOTH red and blue team.

hellsgate

Original C Implementation of the Hell's Gate VX Technique