aggressor_snippets

A collection of random small Aggressor snippets that don't warrant their own repo

backstab_bof

Beacon Object File implementation of Yaxser's Backstab

beatrev

POC for frustrating/defeating Malware Analysts

cohab_processes

A small Aggressor script to help Red Teams identify foreign processes on a host machine

cs_uploads_tracker

Aggressor script add-in for CobaltStrike to track file uploads

cve-2023-36874_bof

Weaponized CobaltStrike BOF for CVE-2023-36874 Windows Error Reporting LPE

dns_tunneling

DNS Tunneling using powershell to download and execute a payload. Works in CLM.

dropspawn_bof

CobaltStrike BOF to spawn Beacons using DLL Application Directory Hijacking

eventvieweruac_bof

Beacon Object File implementation of Event Viewer deserialization UAC bypass

inline-execute-pe

Execute unmanaged Windows executables in CobaltStrike Beacons

jumpsession_bof

Beacon Object File allowing creation of Beacons in different sessions.

kdstab

BOF combination of KillDefender and Backstab

killdefender

A small (Edited) POC to make defender useless by removing its token privileges and lowering the token integrity

killdefender_bof

Beacon Object File implementation of pwn1sher's KillDefender

lnk_generator

Small project to facilitate creation of .lnk payloads

memfiles

A CobaltStrike toolkit to write files produced by Beacon to memory instead of disk

mutants_sessions_self-deletion

Writeup of Payload Techniques in C involving Mutants, Session 1 -> Session 0 migration, and Self-Deletion of payloads.

octoberfest7

osep-tools

presentations

Slide decks and/or materials from conference presentations

proxy_egress_persistence

A post-exploitation strategy for persistence and egress from networks utilizing authenticated web proxies

shoggoth

Shoggoth: Asmjit Based Polymorphic Encryptor

teamsphisher

Send phishing messages and attachments to Microsoft Teams users

xll_phishing

XLL Phishing Tradecraft