toxicnade Goto Github PK

iis-raid

A native backdoor module for Microsoft IIS (Internet Information Services)

inline-execute-pe

Execute unmanaged Windows executables in CobaltStrike Beacons

ioctldump

jomungand

Shellcode Loader with memory evasion

junk

junk

kaynldr

KaynLdr is a Reflective Loader written in C/ASM

kdu

Kernel Driver Utility

killedprocesscanary

A canary designed to minimize the impact from certain Ransomware actors

latloader

PoC module to demonstrate automated lateral movement with the Havoc C2 framework.

lsarelayx

NTLM relaying for Windows made easy

memoryscan

C# PoCs for investigation of Windows process execution techniques

metasploit-payloads

Unified repository for different Metasploit Framework payloads

misc

miscellaneous scripts and programs

nanodump

Dump LSASS like you mean it

net-hook

Backdoor that hooks network socket to give reverse shell on specific type of TCP

netntlmtosilverticket

SpoolSample -> Responder w/NetNTLM Downgrade -> NetNTLMv1 -> NTLM -> Kerberos Silver Ticket

parallelsyscalls

C# version of MDSec's ParallelSyscalls

parallelsyscalls-1

patchlessclrloader

.NET assembly loader with patchless AMSI and ETW bypass

picdumper

pixie-demos

Demos for Pixie: github.com/pixie-io/pixie

povlsomware

Extensionless Ransomware written in C#. Fully compatible with Cobalt Strikes "Execute-Assembly" and Metasploits "Execute_dotnet_assembly". Does not spread laterally, and thus make for an excellent Ransomware Proof of Concept and/or for testing AV Vendors claim of "Ransomware Protection".

process-magics

This is a collection of interesting codes about Windows Process creation.

proxy-function-calls

psbits

Simple (relatively) things allowing you to dig a bit deeper than usual.

public-pentesting-reports

Curated list of public penetration test reports released by several consulting firms and academic security groups

py_winapi

Helper Modules for WINAPI Functions for Python Ctypes

randomscripts

Scripts for public use that we've randomly written, or have updated from other people's work.

ransomware-detection

Visual C++ console application to detect ransomware activity on Windows OS. It consists of a registry monitor, filesystem watcher and a process detector.

ransomwatch

Ransomware detection application for Windows using Windows Minifilter driver