og-sadpanda Goto Github PK

aceldr

Cobalt Strike UDRL for memory scanner evasion.

alcatraz

x64 binary obfuscator

alternativeshellcodeexec

Alternative Shellcode Execution Via Callbacks

amd-ryzen-master-driver-v17-exploit

Cobalt Strike (CS) Beacon Object File (BOF) for kernel exploitation using AMD's Ryzen Master Driver (version 17).

apcldr

Payload Loader With Evasion Features

asrenum-bof

Cobalt Strike BOF that identifies Attack Surface Reduction (ASR) rules, actions, and exclusion locations

bitb

Browser In The Browser (BITB) Templates

bofs

Beacon Object Files (not Buffer Overflows)

burp2malleable

Quick python utility I wrote to turn HTTP requests from burp suite into Cobalt Strike Malleable C2 profiles

c2-tool-collection

A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techniques.

cobaltwhispers

CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files (BOF) for Cobalt Strike to perform process injection, persistence and more, leveraging direct syscalls (SysWhispers2) to bypass EDR/AV

codecepticon

coercer

A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 12 methods.

cohab_processes

A small Aggressor script to help Red Teams identify foreign processes on a host machine

crassus

cs-situational-awareness-bof

Situational Awareness commands implemented using Beacon Object Files

cve-2022-42046

CVE-2022-42046 Proof of Concept of wfshbr64.sys local privilege escalation via DKOM

dearg-thread-ipc-stealth

A novel technique to communicate between threads using the standard ETHREAD structure

dirty-vanity

A POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.html#dirty-vanity-a-new-approach-to-code-injection--edr-bypass-28417

dragoncastle

A PoC that combines AutodialDLL lateral movement technique and SSP to scrape NTLM hashes from LSASS process.

embedinhtml

Embed and hide any file in an HTML file

evilnovnc

Ready to go Phishing Platform

golddigger

havoc

The Havoc Framework

hellhall

Performing Indirect Clean Syscalls

inline-execute-pe

Execute unmanaged Windows executables in CobaltStrike Beacons

kernel-cactus

It's pointy and it hurts!

kernel-mii

Cobalt Strike (CS) Beacon Object File (BOF) foundation for kernel exploitation using CVE-2021-21551.

koppeling

Adaptive DLL hijacking / dynamic export forwarding

lazzzy

laZzzy is a shellcode loader, developed using different open-source libraries, that demonstrates different execution techniques.