xalicex Goto Github PK

abuse

(FR) Informations de contact de l'équipe Abuse de l'Assurance Maladie. (EN) Contact infos of the Assurance Maladie Abuse team.

ad-description-password-finder

Retrieve AD accounts description and search for password in it

adduser

Programmatically create an administrative user under Windows

adduser_dll

antivirus-artifacts

Anti-virus artifacts. Listing APIs hooked by: Avira, BitDefender, F-Secure, MalwareBytes, Norton, TrendMicro, and WebRoot.

antivmdetection

Script to create templates to use with VirtualBox to make vm detection harder

apc-injection

Process Injection: APC Injection

artillery

CIA UAC bypass implementation that utilizes elevated COM object to write to System32 and an auto-elevated process to execute as administrator.

assurancemaladiesec.github.io

Website of the IT Security team of Assurance Maladie (French public Health Insurance)

beginning-x64-assembly-programming

Source Code for 'Beginning x64 Assembly Programming' by Jo Van Hoey

biodiff

Hex diff viewer using alignment algorithms from biology

blackhoodie_maldev101_2022

blackout

kill anti-malware protected processes using BYOVD

bloatedhammer

API Hammering with C++20

bloodhoundqueries

capev2

Malware Configuration And Payload Extraction

chaos-rootkit

x64 ring0 rootkit with process hiding, privilege escalation, and capabilities for protecting and unprotecting processes

chntpw

Archive of the chntpw source code from the official website http://pogostick.net/~pnh/ntpasswd/ (just in case)

conference_talks

Slides from various conference talks

convert-plain-text-to-nt-hash

Convert plain text string to Windows NT hash (SAM & NTDS)

cuckoo-sandbox-installation-script

cuckoo3

Cuckoo 3 is a Python 3 open source automated malware analysis system.

cve-2023-24055

POC and Scanner for CVE-2023-24055

detours

Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed in source code form.

dirty-vanity

A POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.html#dirty-vanity-a-new-approach-to-code-injection--edr-bypass-28417

donut

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters

driverentry-example

drvmon

Advanced driver monitoring utility.

dse_pg_bypass

DSE & PG bypass via BYOVD attack

dumpr

Dumping processes using a kernel-mode driver.