noostudent Goto Github PK

proxy-function-calls-for-etwti

The code is a pingback to the Dark Vortex blog: https://0xdarkvortex.dev/hiding-memory-allocations-from-mdatp-etwti-stack-tracing/

pwnedpasswordsntlm

Quick binary search for NTLM hash dataset

pxethief

PXEThief is a set of tooling that can extract passwords from the Operating System Deployment functionality in Microsoft Endpoint Configuration Manager

realtaiizor

.NET WinForms UI/UX Component Library

rebeacon_forclang

Beacon compiled using clang

rebeacon_src

reflectivedllinjection

Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process.

reflectivedllinjectionpoc

regeorg

The successor to reDuh, pwn a bastion webserver and create SOCKS proxies through the DMZ. Pivot and pwn.

reverse_dns_shell

A python reverse shell that uses DNS as the c2 channel

rubeus

Trying to tame the three-headed dog.

runpe

C# Reflective loader for unmanaged binaries.

samnetuseradd

shad0w

A post exploitation framework designed to operate covertly on heavily monitored environments

sharpbeacon

CobaltStrike Beacon written in .Net 4 用.net重写了stager及Beacon，其中包括正常上线、文件管理、进程管理、令牌管理、结合SysCall进行注入、原生端口转发、关ETW等一系列功能

sharpdecryptpwd-1

SharpDecryptPwd source, To Decrypt Navicat,Xmanager,Filezilla,Foxmail,WinSCP,etc

sharpdpapi

SharpDPAPI is a C# port of some Mimikatz DPAPI functionality.

sharpfrp

sharpgetuserloginiprpc

提取域控日志，支持远程提取

sharpsocks

Tunnellable HTTP/HTTPS socks4a proxy written in C# and deployable via PowerShell

shellcode_for_fileless_wmi_backdoor

using shellcode to add wmi fileless backdoor

shellcodetemplate

An easily modifiable shellcode template for Windows x64/x86

sigflip

SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.

sigthief

Stealing Signatures and Making One Invalid Signature at a Time

sliver

Adversary Emulation Framework

spoolfool

Exploit for CVE-2022-21999 - Windows Print Spooler Elevation of Privilege Vulnerability (LPE)

srdi

Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

syscaller

Single header library to simplify the usage of direct syscalls. x64/x86

syscallpack

BOF and Shellcode for full DLL unhooking using dynamic syscalls

sysmon-config

Sysmon configuration file template with default high-quality event tracing