brucebatman Goto Github PK

alternativeshellcodeexec

Alternative Shellcode Execution Via Callbacks

atomldr

A DLL loader with advanced evasive features

augustus

Evasive Golang Loader

batdllloader

BatBasic BatDLL BatLoader and injection into a Bat Process.

bin2shellcode

.bin file to shellcode convertor

blackout

kill anti-malware protected processes (BYOVD)

bof-patchit

An all-in-one Cobalt Strike BOF to patch, check and revert AMSI and ETW for x64 process. Both syscalls and dynamic resolve versions are available.

bypassav

This map lists the essential techniques to bypass anti-virus and EDR

christmas

cloudflare-redirector

Just another C2 Redirector using CloudFlare.

cobaltstrike_redteam_cheatsheet

Useful Cobalt Strike techniques learned from engagements

codecepticon

.NET/PowerShell/VBA Offensive Security Obfuscator

confuserex

An open-source, free protector for .NET applications

cordyceps

C++ self-Injecting dropper based on various EDR evasion techniques.

create-thread-shellcode-fetcher

This POC gives you the possibility to compile a .exe to completely avoid statically detection by AV/EPP/EDR of your C2-shellcode and download and execute your C2-shellcode which is hosted on your (C2)-webserver.

csharp-alt-shellcode-callbacks

A collection of (even more) alternative shellcode callback methods in CSharp

cssg

Cobalt Strike Shellcode Generator

defender-control

An open-source windows defender manager. Now you can disable windows defender permanently.

defender-detectionhistory-parser

A parser of Windows Defender's DetectionHistory forensic artifact, containing substantial info about quarantined files and executables.

defender_exclusions-bof

A BOF to determine Windows Defender exclusions.

echodrv

Exploitation of echo_driver.sys

espio

Shellcode obfuscation tool to avoid AV/EDR.

etwunhook

Simple ETW unhook PoC. Overwrites NtTraceEvent opcode to disable ETW at Nt-function level.

execit

Execute shellcode files with rundll32

formthief

Spoofing desktop login applications with WinForms and WPF

freeze

Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods

ghostlyhollowingviatamperedsyscalls

Implementing the ghostly hollowing PE injection technique using tampered syscalls.

ghosttask

hooka

Evasive shellcode loader, hooks detector and more

inflativeloading

Dynamically convert a native EXE to PIC shellcode by appending a shellcode stub