antirookit Goto Github PK

doge-newsyscall

use shellcode as asm function

doge-recycledgate

Golang implementation of Hellsgate + Halosgate/Tartarosgate. Ensures that all systemcalls go through ntdll.dll;

doge-whisper

golang implementation of Syswhisper2/Syswhisper3

donut

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters

doppelgate

DoppelGate relies on reading ntdll on disk to grab syscall stubs, and patches these syscall stubs into desired functions to bypass Userland Hooking.

dragoncastle

A PoC that combines AutodialDLL lateral movement technique and SSP to scrape NTLM hashes from LSASS process.

driploader

Evasive shellcode loader for bypassing event-based injection detection (PoC)

drivernoimage

以shellcode注入其它驱动执行，躲避驱动签名检测，曾pubg项目中使用，，，当然现在，，，

drivers_and_shit

drv-vuln-scanner

Finds imports that could be exploited, still requires manual analysis.

dunet

C# discriminated union source generator

easynet

Simple packer for arbitrary data using only .NET API calls. Produces a unique signature with every usage. Standalone program and library. Algorithm: Data <-> GZip <-> AES-256 <-> Base64.

easypen

EasyPen is a GUI program which helps pentesters do information gathering, vulnerability scan and exploitation

edd

Enumerate Domain Data

edrs

edrsandblast

ekko

Sleep Obfuscation

ekko_cfg_bypass

A PoC for adding NtContinue to CFG allowed list in order to make Ekko work in a CFG protected process

elevator

UAC Bypass by abusing RPC and debug objects.

encryptor

Windows shellcode encoding and encrypting tool

envschtasksuacbypass

Bypass UAC elevation on Windows 8 (build 9600) & above.

etwprocessmon2

ETWProcessMon2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detection by VirtualMemAlloc Events (in-memory) etc.

ev

EV: IDS Evasion via Packet Manipulation

evilgophish

evilginx2 + gophish

evilnovnc

Ready to go Phishing Platform

exceptionorientedprogramming

exe_who

Executables on Disk? Bleh 🤮

execremoteassembly

Execute Remote Assembly with args passing and with AMSI and ETW patching

firefox-webinject

Firefox webInjector capable of injecting codes into webpages usint a mitmproxy.

follina.py

POC to replicate the full 'Follina' Office RCE vulnerability for testing purposes