klezVirus

inceptor. Template-Driven AV/EDR Evasion Framework

SysWhispers3. SysWhispers on Steroids - AV/EDR evasion via direct system calls.

SilentMoonwalk. PoC Implementation of a fully dynamic call stack spoofer

CVE-2021-40444. CVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit

CheeseTools. Self-developed tools for Lateral Movement/Code Execution

chameleon. PowerShell Script Obfuscator

vortex. VPN Overall Reconnaissance, Testing, Enumeration and eXploitation Toolkit

DriverJack. Hijacking valid driver services to load arbitrary (signed) drivers abusing native symbolic links and NT paths

CandyPotato. Pure C++, weaponized, fully automated implementation of RottenPotatoNG

RAIWhateverTrigger. Local SYSTEM auth trigger for relaying - X

SharpSelfDelete. C# implementation of the research by @jonaslyk and the drafted PoC from @LloydLabs

NimlineWhispers3. A tool for converting SysWhispers3 syscalls for use with Nim projects

RpcProxyInvoke. Simple POC library to execute arbitrary calls proxying them via NdrServerCall2 or similar

klezVirus.github.io. CyberSec Blog

SharpLdapRelayScan. C# Port of LdapRelayScan

koppeling-p. Adaptive DLL hijacking / dynamic export forwarding - EAT preserve

evilginx-collection. Public repo of some woking evilginx phishlets

obfuscator. ollvm, based on llvm-clang 5.0.2, 6.0.1, 7.0.1, 8.0, 9.0, 9.0.1

DCKFinder. Dangling COM Keys Finder

AIDA64DRIVER-EoP. AIDA64DRIVER Elevation of Privilege Vulnerability

titanldr-ng. A newer iteration of TitanLdr with some newer hooks, and design. A generic user defined reflective DLL I built to prove a point to Mudge years ago.

LoGiC.NET. A more advanced free and open .NET obfuscator using dnlib.

codegrepper. Pure python, self-contained, silly implementation of a SAST tool

AsStrongAsFuck. A console obfuscator for .NET assemblies.

deser-node. NodeJS Deserialization Payload Generator

HWSyscalls. HWSyscalls is a new method to execute indirect syscalls using HWBP, HalosGate and a synthetic trampoline on kernel32 with HWBP.

LdrLibraryEx. A small x64 library to load dll's into memory.

msf-revhttp-gen. Little utility to facilitate Metasploit Reverse HTTP Payloads

faceless. Faceless - Simple Tool for Text-File Anonymization

mapt-run. Simple script to setup a local hosted network for Mobile Application Penetration Testing

nmap-report. A simple tool that can be use to extract usful information from a nmap scan

BOFRyptor. Assembly

LazySign. Create fake certs for binaries using windows binaries and the power of bat files

CryptoCheck. NIST-CAVS Extended - Encryption Auto Testing Toolkit

nx_reporter. Rapid7 Nexpose template-based report generator

overlord. Overlord - Red Teaming Infrastructure Automation

angryorchard. A kernel vulnerability used to achieve arbitrary read-write on Windows prior to July 2022

muts-opt-encoder. Independent implementation of the optimized SUB-Encoder

XSStrike. Most advanced XSS scanner.

deser-py. Python Deserialization Payload Generator

klezVirus. Temporary unavailable...

camanager. A simple CA management utility for generating certificates based on a local CA

deser-ruby. Ruby Deserialization Payload Generator

HandleKatz. PIC lsass dumper using cloned handles

donut. Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters

ADCSPwnNG. A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service.

oldrivrs. some old drivers and misc crap from a while ago

MalMemDetect. Detect strange memory regions and DLLs

sam-the-admin. Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user

SylantStrike. Simple EDR implementation to demonstrate bypass

trevorc2. TrevorC2 is a legitimate website (browsable) that tunnels client/server communications for covert command execution.

SharpHellsGate. C# Implementation of the Hell's Gate VX Technique

GadgetToJScript. A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA based scripts.