tsjohn Goto Github PK

pe_to_shellcode

Converts PE into a shellcode

phantom-dll-hollower-poc

Phantom DLL hollowing PoC

powerob

An on-the-fly Powershell script obfuscator meant for red team engagements. Built out of necessity.

pplblade

Protected Process Dumper Tool

ppldump

Dump the memory of a PPL with a userland exploit

pplfault

pplinject

Inject unsigned DLL into Protected Process Light (PPL)

pplkiller

Tool to bypass LSA Protection (aka Protected Process Light)

pplkiller-1

Protected Processes Light Killer

ppll

Protected Process Light Library

pplmedic

Dump the memory of any PPL with a Userland exploit chain

pplrunner

Run Processes as PPL with ELAM

printnotifypotato

PrintNotifyPotato

pyfuscation

Obfuscate powershell scripts by replacing Function names, Variables and Parameters.

pypykatz

Mimikatz implementation in pure Python

quasar

Remote Administration Tool for Windows

rdi-srdi

This repo goes with the blog entry at blog.malicious.group entitled "Writing your own RDI / sRDI loader using C and ASM".

reg-restore-persistence-mole

a short C code POC to gain persistence and evade sysmon event code registry (creation, update and deletion) REG_NOTIFY_CLASS Registry Callback of sysmon driver filter. RegSaveKeyExW() and RegRestoreKeyW() API which is not included in monitoring. This POC will use

regeorg

The successor to reDuh, pwn a bastion webserver and create SOCKS proxies through the DMZ. Pivot and pwn.

remoteshellcodeexec

Execute shellcode from a remote-hosted bin file using Winhttp.

rp

rp++ is a fast C++ ROP gadget finder for PE/ELF/Mach-O x86/x64/ARM/ARM64 binaries.

rpcview

RpcView is a free tool to explore and decompile Microsoft RPC interfaces

rtoolz

A Stealthy Lsass Dumper - can abuse ProcExp152.sys driver to dump PPL Lsass, no dbghelp.lib calls.

session-android

A private messenger for Android.

sharptoken

Windows Token Stealing Expert

socks5server

Windows C/C++ Socks5 Server

study_note

systeminformer

A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ http://www.windows-internals.com

thefatrat

Thefatrat a massive exploiting tool : Easy tool to generate backdoor and easy tool to post exploitation attack like browser attack and etc . This tool compiles a malware with popular payload and then the compiled malware can be execute on windows, android, mac . The malware that created with this tool also have an ability to bypass most AV software

tiny-bignum-c

Small portable multiple-precision unsigned integer arithmetic in C