A modern 64-bit position independent implant template

You shall pass

An interactive command prompt for red teaming and pentesting. Pushes commands through proxychains via Cobalt Strike beacon socks proxies or custom proxies. Automatically logs activities on a Cobalt…

Comparing, discussing, and bypassing various techniques for suspending and freezing processes on Windows.

Cobalt Strike Malleable C2 Design and Reference Guide

The source code files that accompany the short book "Building C2 Implants in C++: A Primer" by Steven Patterson (@shogunlab).

Exploiting DLL Hijacking by DLL Proxying Super Easily

Abuses the Shared Logon Session ID Issue (Described [here](https://www.tiraniddo.dev/2020/04/sharing-logon-session-little-too-much.html) by the awesome James Forshaw) To Achieve System From Network…

Example code for using named pipe output with beacon ReflectiveDLLs

GhostLoader - AppDomainManager - Injection - 攻壳机动队

Retired beginner/intermediate malware analysis training materials from @pedramamini and @erocarrera.

Set of tools to analyze and attack Windows sandboxes.

Load PE via XML Attribute

MSBuild Without MSBuild.exe

PowerSploit - A PowerShell Post-Exploitation Framework

UAC bypass, Elevate, Persistence and Execution methods

.NET implementation of Get-GPPPassword. Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.

Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

This repository was created and developed by Ammar Amer @cry__pto Only. Updates to this repository will continue to arrive until the number of links reaches 10000 links & 10000 pdf files .Learn Eth…

Circumvent AMSI by patching AmsiScanBuffer

Random Tools

Auto-generate an HTaccess for payload delivery -- automatically pulls ips/nets/etc from known sandbox companies/sources that have been seen before, and redirects them to a benign payload.

Collection of CSharp Assemblies focused on Post-Exploitation Capabilities

a tool to make it easy and fast to test various forms of injection

Great explanation of Process Hollowing (a Technique often used in Malware)

Loads .NET Assembly Via CLR Loader

subTee gists code backups