antirookit Goto Github PK

elevator

UAC Bypass by abusing RPC and debug objects.

encryptor

Windows shellcode encoding and encrypting tool

envschtasksuacbypass

Bypass UAC elevation on Windows 8 (build 9600) & above.

etwprocessmon2

ETWProcessMon2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detection by VirtualMemAlloc Events (in-memory) etc.

ev

EV: IDS Evasion via Packet Manipulation

evilgophish

evilginx2 + gophish

evilnovnc

Ready to go Phishing Platform

evtx-etw-resources

Event Tracing For Windows (ETW) Resources

exceptionorientedprogramming

exe_who

Executables on Disk? Bleh 🤮

execremoteassembly

Execute Remote Assembly with args passing and with AMSI and ETW patching

findrpc

Idapython script to carve binary for internal RPC structures

firefox-webinject

Firefox webInjector capable of injecting codes into webpages usint a mitmproxy.

follina.py

POC to replicate the full 'Follina' Office RCE vulnerability for testing purposes

freeze

Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods

frostbyte

FrostByte is a POC project that combines different defense evasion techniques to build better redteam payloads

fud-uuid-shellcode

functionstomping

A new shellcode injection technique. Given as C++ header or standalone Rust program.

gbbypass

冰蝎 哥斯拉 WebShell bypass

geacon

Using Go to implement CobaltStrike's Beacon

geacon-1

Practice Go programming and implement CobaltStrike's Beacon in Go

geacon_pro

跨平台重构了Cobaltstrike Beacon，适配了大部分Beacon的功能，行为对国内主流杀软免杀，支持4.1以上的版本。 A cobaltstrike Beacon bypass anti-virus, supports 4.1+ version.

getwebdavstatus

Determine if the WebClient Service (WebDAV) is running on a remote system

goad

game of active directory

gomasscan

gomasscan是一个纯go编写的masscan扫描库

gosecretsdump

Dump ntds.dit really fast

gpusleep

Move CS beacon to GPU memory when sleeping

gremlins

halosunhooker

Halos Gate-based NTAPI Unhooker

handlekatz

PIC lsass dumper using cloned handles