Kurosh Dabbagh Escalante

Elevator. UAC bypass by abusing RPC and debug objects.

Shelter. ROP-based sleep obfuscation to evade memory scanners

Unwinder. Call stack spoofing for Rust

DInvoke_rs. Dynamically invoke arbitrary unmanaged code

EPI. Threadless Process Injection through entry point hijacking

MFTool. Direct access to NTFS volumes

Split. Apply a divide and conquer approach to bypass EDRs

Dumpy. Reuse open handles to dynamically dump LSASS.

Fiber. Using fibers to run in-memory code.

LOLBITS. ** DISCONTINUED ** C2 framework that uses Background Intelligent Transfer Service (BITS) as communication protocol and Direct Syscalls + Dinvoke for EDR user-mode hooking evasion.

ADPT. DLL proxying for lazy people

Eclipse. Activation Context Hijack

RustChain. Hide memory artifacts using ROP and hardware breakpoints.

Bin-Finder. Detect EDR's exceptions by inspecting processes' loaded modules

rust_tips_and_tricks. Rust For Windows Cheatsheet

Puzzle. Set of PoC to abuse Windows minifilters functionality

CustomEntryPoint. Select any exported function in a dll as the new dll's entry point.

RustHollow. Inject a shellcode in a remote process using Process Hollowing.

litcrypt.rs. A Rust compiler plugin to encrypt string literal at compile time.

Scripts. Repository for dirty scripts and PoCs