kfriitz Goto Github PK

aescryptfiles

AES-256 Microsoft Cryptography API Example Use.

alternativeshellcodeexec

Alternative Shellcode Execution Via Callbacks

amsi-etw-patch

Patch AMSI and ETW

bypasscredguard

Credential Guard Bypass Via Patching Wdigest Memory

checkhooks-n-load

A Windows stager-cum-PELoader focusing Dynamic EDR Evasion, when Operator wants to Know the the Underlying functions Hooks and then craft Implant based on the previous condition.

cronos

PoC for a new sleep obfuscation technique leveraging waitable timers to evade memory scanners.

cve-2023-23397-poc-powershell

cve-2023-36874-privesc-winx

deleteshadowcopies

Deleting Shadow Copies In Pure C++

dircreate2system

Weaponizing to get NT SYSTEM for Privileged Directory Creation Bugs with Windows Error Reporting

dllsideloader

C++ port of the awesome Nim Dll Sideload (https://github.com/byt3bl33d3r/NimDllSideload/tree/main)

dragnmove

Infect Shared Files In Memory for Lateral Movement

dropper

Project that generates Malicious Office Macro Enabled Dropper for DLL SideLoading and Embed it in Lnk file to bypass MOTW

dumpthatlsass

Dumping LSASS by Unhooking MiniDumpWriteDump by getting a fresh DbgHelp.dll copy from the disk , plus functions and strings obfuscation

emailfinder

Search emails from a domain through search engines

encryptedreaper

A program to encrypt a binary to bypass static detection and aid in loader or dropper development and hide your payload in the resource section.

etwpatching

Patching Event Tracing for Windows, by overwriting "call ntdll!EtwpEventWriteFull" inside ntdll!EtwEventWrite , the patched call do the actual Event Writing

execremoteassembly

Execute Remote Assembly with args passing and with AMSI and ETW patching

execute-assembly

filelessremotepe

Loading Fileless Remote PE from URI to memory with argument passing and ETW patching and NTDLL unhooking and No New Thread technique

freeze

Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods

ghettovcb

ghettoVCB

hwsyscalls

HWSyscalls is a new method to execute indirect syscalls using HWBP, HalosGate and a synthetic trampoline on kernel32 with HWBP.

idisagree

Control remote computers using discord bot and python 3.

inmemorynet

Exploring in-memory execution of .NET

latloader

PoC module to demonstrate automated lateral movement with the Havoc C2 framework.

mhddos

Best DDoS Attack Script Python3, Cyber Attack With 36 Method

misc

miscellaneous scripts and programs

myruby

ninja_uuid_runner

Module Stomping, No New Thread, HellsGate syscaller, UUID Shellcode Runner for x64 Windows 10!