an0x03e8 Goto Github PK

aceldr

Cobalt Strike UDRL for memory scanner evasion.

alaris

A protective and Low Level Shellcode Loader that defeats modern EDR systems.

alternativeshellcodeexec

Alternative Shellcode Execution Via Callbacks

am0n-eye

arsenal-rs

Rusty Process Injection / Post-Exploitation Techniques

autorecon

AutoRecon is a multi-threaded network reconnaissance tool which performs automated enumeration of services.

avred

Analyse your malware to chirurgicaly obfuscate it

avred-server

bin-finder

Detect EDR's exceptions by inspecting processes' loaded modules

bof-vs

A Beacon Object File (BOF) template for Visual Studio

c_syscalls

Single stub direct and indirect syscalling with runtime SSN resolving for windows.

callstack-spoofer

This tool will allow you to spoof the return addresses of your functions as well as system functions.

callstackspoofer

A PoC implementation for spoofing arbitrary call stacks when making sys calls (e.g. grabbing a handle via NtOpenProcess)

checkplease

Sandbox evasion modules written in PowerShell, Python, Go, Ruby, C, C#, Perl, and Rust.

christmas

clrinjector

A PoC .NET-specific process injection tool

cobalt-strike-profiles-for-edr-evasion

Cobalt Strike Profiles for EDR Evasion

codecepticon

coffee

A COFF loader made in Rust

coffloader

coffloader2

Load and execute COFF files and Cobalt Strike BOFs in-memory

combine_harvester

Rust in-memory dumper

contextmenuhijack

Execute a payload at each right click on a file/folder in the explorer menu for persistence

cs-remote-ops-bof

cthreadhijack

Beacon Object File (BOF) for remote process injection via thread hijacking

customentrypoint

Select any exported function in a dll as the new dll's entry point.

d1rkinject

Another approach of Threadless injection discovered by @_EthicalChaos_ in c that loads a module into the target process and stomps it, and reverting back memory protections and original memory state

d1rklrd

Shellcode Loader with Indirect Dynamic syscall Implementation , shellcode in MAC format, API resolving from PEB, Syscall calll and syscall instruction address resolving at run time

darkloadlibrary

LoadLibrary for offensive operations

dinvoke

Dynamically invoke arbitrary unmanaged code from managed code without PInvoke.