0xrobert Goto Github PK

halosunhooker

Halos Gate-based NTAPI Unhooker

handlekatz

PIC lsass dumper using cloned handles

hardhatc2

A c# Command & Control framework

havoc

The Havoc Framework

heroinn

A cross platform C2/post-exploitation framework.

hidden

🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

hide_execute_memory

隐藏可执行内存

higurashi

hoaxshell

An unconventional Windows reverse shell, currently undetected by Microsoft Defender and various other AV solutions, solely based on http(s) traffic.

hollows_hunter

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

hwbp4mw

hygieia

Hygieia, a vulnerable driver traces scanner written in C++ as an x64 Windows kernel driver.

impacket

Impacket is a collection of Python classes for working with network protocols.

impulsivedllhijack

C# based tool which automates the process of discovering and exploiting DLL Hijacks in target binaries. The Hijacked paths discovered can later be weaponized during Red Team Operations to evade EDR's.

in-memory-cpython

An In-memory Embedding of CPython

inceptor

Template-Driven AV/EDR Evasion Framework

injection

Windows process injection methods

insightengineering

interprocesscommunication-samples

Some Code Samples for Windows based Inter-Process-Communication (IPC)

inveigh

.NET IPv4/IPv6 machine-in-the-middle tool for penetration testers

invoke-obfuscation

PowerShell Obfuscator

iori_loader

UUID shellcode Loader with dynamic indirect syscall implementation, syscall number/instruction get resolved dynamicaly at runtime, and the syscall number/instruction get unhooked using Halosgate technique. Function address get resolved from the PEB by offsets and comparaison by hashes

ivy

Ivy is a payload creation framework for the execution of arbitrary VBA (macro) source code directly in memory. Ivy’s loader does this by utilizing programmatical access in the VBA object environment to load, decrypt and execute shellcode.

juicypotatong

Another Windows Local Privilege Escalation from Service Account to System

justc2file

Burp插件，Malleable C2 Profiles生成器；可以通过Burp代理选中请求，生成Cobalt Strike的profile文件(CSprofile)

katana

A next-generation crawling and spidering framework.

kaynldr

KaynLdr is a Reflective Loader written in C/ASM

keefarcereborn

A standalone DLL that exports databases in cleartext once injected in the KeePass process.

keinject

Kernel LdrLoadDll injector

kerberoast

Kerberoast attack -pure python-