sneakid Goto Github PK

.netconfigloader

.net config loader

adamantium-thief

:key: Decrypt chromium based browsers passwords, cookies, credit cards, history, bookmarks, autofill. Version > 80 is supported.

alanframework

A C2 post-exploitation framework

anti-delete

Protects deletion of files with a specified extension using a kernel-mode driver.

apc-research

APC Internals Research Code

ares

Project Ares is a Proof of Concept (PoC) loader written in C/C++ based on the Transacted Hollowing technique

backup_filter_driver_sample

bedaisy

reverse engineering of bedaisy.sys (battleyes kernel driver) - Aki2k/BEDaisy

brokenflow

A simple PoC to invoke an encrypted shellcode by using an hidden call

bsidestlv2023

It's Duck Season, Hunting Bad-USB Attacks

bumblecrypt

A Bumblebee-inspired Crypter

callstack-spoofer

This tool will allow you to spoof the return addresses of your functions as well as system functions.

callstackspoofer

A PoC implementation for spoofing arbitrary call stacks when making sys calls (e.g. grabbing a handle via NtOpenProcess)

callstackspoofingpoc

C++ self-Injecting dropper based on various EDR evasion techniques.

checkhooks-n-load

A Windows stager-cum-PELoader focusing Dynamic EDR Evasion, when Operator wants to Know the the Underlying functions Hooks and then craft Implant based on the previous condition.

dc30-phineastalk

Slides for the talk we presented as UniPi at DefCon's Red Team Village

duplicatedump

Dumping LSASS with a duplicated handle from custom LSA plugin

etwsessionhijacking

A Poc on blocking Procmon from monitoring network events

exception-ret-spoofing

A simple way to spoof return addresses using an exception handler

goodeye

https://githacks.org/Shawick/goodeye.git

hackbrowserdata

Decrypt passwords/cookies/history/bookmarks from the browser. 一款可全平台运行的浏览器数据导出解密工具。

halosunhooker

Halos Gate-based NTAPI Unhooker

harvestbrowserpasswords

Tool for extracting credentials locally stored by web browsers

hiddendesktop

HVNC for Cobalt Strike

hiding-your-syscalls

Some source code to demonstrate avoiding certain direct syscall detections by locating and JMPing to a legitimate syscall instruction within NTDLL.

hooking-by-example

A series of increasingly complex programs demonstrating function hooking on 64 bit Windows. Culminating in a program that hooks mspaint to make it always paint orange.

hvnc

Standalone HVNC Client & Server | Coded in C++ (Modified Tinynuke)

hvnc-bot-2021

hwbp4mw

hwsyscalls

HWSyscalls is a new method to execute indirect syscalls using HWBP, HalosGate and a synthetic trampoline on kernel32 with HWBP.