r-secure Goto Github PK

amsi-bypasses

This repository contains several AMSI bypasses. These bypasses are based on some very nice research that has been put out by some awesome people. I really recommend checking them out: https://i.blackhat.com/Asia-22/Friday-Materials/AS-22-Korkos-AMSI-and-Bypass.pdf and https://rastamouse.me/memory-patching-amsi-bypass/

com-hijacking

crackmapexec

A swiss army knife for pentesting networks

dll

DLL

fodhelper-uac-bypass

C# implementation of the Fodhelper UAC bypass. As mentioned in s3cur3th1ssh1t's blogpost (https://s3cur3th1ssh1t.github.io/Signature_vs_Behaviour/) Defender does not like any .exe in the HKCU:\Software\Classes\ms-settings\Shell\Open\command(Default) entry. We don't need to specify .exe to execute a binary, but running unsigned executables is not really good practice. We can copy rundll to a writable location and execute it from there.

sharpagent

C# havoc implant

teamfiltration

TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts

temp

temp

xss

xss

xss-payload

xss payload