primody Goto Github PK

cpuid

A class to emulate the behavior of NtQuerySystemInformation when passed the SystemHypervisorDetailInformation information class

crackmaster

x86/x64 Ring 0/-2 System Freezer/Debugger

csshide

Encodes a payload within a generated mock-CSS file

cswhispers

Source generator to add D/Invoke and indirect syscall methods to a C# project.

curlshell

reverse shell using curl

customprocessingunit

The first analysis framework for CPU microcode

cve-2023-27470_exercise

d0zer

Elf binary infector written in Go.

d3m0n1z3dshell

Demonized Shell is an Advanced Tool for persistence in linux.

dangerzone

Take potentially dangerous PDFs, office documents, or images and convert them to safe PDFs

davrelayup

DavRelayUp - a universal no-fix local privilege escalation in domain-joined windows workstations where LDAP signing is not enforced (the default settings).

delete-self-poc

A way to delete a locked file, or current running executable, on disk.

deskbypass

detenv

A small and portable Windows C library for sandbox detection

dirty-vanity

A POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.html#dirty-vanity-a-new-approach-to-code-injection--edr-bypass-28417

dirtyclr

An App Domain Manager Injection DLL PoC on steroids

dll-spoofer

POC for a DLL spoofer to determine DLL Hijacking

dotnet_xorcryptor

A new simple and powerfull packer for malware

dropspawn_bof

CobaltStrike BOF to spawn Beacons using DLL Application Directory Hijacking

dvenom

🐍 Double Venom (DVenom) is a tool that provides an encryption wrapper and loader for your shellcode.

earlybird-apc-injection

Demonstration of Early Bird APC Injection - MITRE ID T1055.004

echodrv

Exploitation of echo_driver.sys

edraser

edrception

A proof of concept for abusing exception handlers to hook and bypass user mode EDR hooks.

edrsandblast-godfault

EDRSandblast-GodFault

edrsilencer

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

etwprocessmon2

ETWProcessMon2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detection by VirtualMemAlloc Events (in-memory) etc.

eventlogcrasher

evilrdp

evilsln

A New Exploitation Technique for Visual Studio Projects