xkroot Goto Github PK

shellcode_memory_loader

基于Golang实现的Shellcode内存加载器,共实现3中内存加载shellcode方式,UUID加载,MAC加载和IPv4加载,目前能过主流杀软(包括Windows Defender)

shellcodeloader-1

AV Bypass Shellcode Loader

shellcodeloader-2

shellghost

A memory-based evasion technique which makes shellcode invisible from process start to end.

shellmon

ShellMon is a webserver monitor based on inotify-tools.It can monitor modifications(new,del,etc) of web folders and check whether it contains malware.

shhhloader

Syscall Shellcode Loader (Work in Progress)

shinigami

A dynamic unpacking tool

shiroattack2

shiro反序列化漏洞综合利用,包含（回显执行命令/注入内存马）修复原版中NoCC的问题 https://github.com/j1anFen/shiro_attack

sigflip

SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.

signature-base

YARA signature and IOC database for my scanners and tools

simpleremoter

基于gh0st的远程控制器：实现了终端管理、进程管理、窗口管理、远程桌面、文件管理、语音管理、视频管理、服务管理、注册表管理等功能，优化全部代码及整理排版，修复内存泄漏缺陷，程序运行稳定。项目代码仅限于学习和交流用途。

sinmapper

usermode driver mapper that forcefully loads any signed kernel driver (legit cert) with a big enough section (example: .data, .rdata) to map your driver over

siph0n-rootkit

solorigate_sample_source

Decompile of the Solorwinds "SUNBURST" Trojan associated with Campaign UNC2452 This is the SolarWinds.Orion.Core.BusinessLayer.dll file from the v2019.4.5220-Hotfix5.msp Patch

spark

✨Spark is a web-based, cross-platform and full-featured Remote Administration Tool (RAT) written in Go that allows you control all your devices anywhere. Spark是一个Go编写的，网页UI、跨平台以及多功能的远程控制和监控工具，你可以随时随地监控和控制所有设备。

srdi

Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

sshdhooker

One-click injection into the SSHD process to record and send the password for ssh login

stealerium

Stealer + Clipper + Keylogger

steganography

Pure Golang Library that allows simple LSB steganography on images

stfuedr

Silence EDRs by removing kernel callbacks

stormkitty

:key: Open source stealer written on C#, all logs will be sent to Telegram bot.

suo5

A high-performance http proxy tunneling tool

superman

Kill processes protected by antivirus during offensive activities.

supernova

Real fucking shellcode encryption tool.

syserdebugger

syshttphooksleep

集合多种方式的ShellcodeLoader

syswhispers2

AV/EDR evasion via direct system calls.

syswhispers3

SysWhispers on Steroids - AV/EDR evasion via direct system calls.

syswhispers3winhttp

SysWhispers3WinHttp 基于SysWhispers3项目增添WinHttp分离加载功能，可免杀绕过360核晶与Defender。

tartarus-tpallocinject