Tim MalcomVetter

CSExec. An implementation of PSExec in C#

ManagedInjection. A proof of concept for dynamically loading .net assemblies at runtime with only a minimal convention pre-knowledge

NamedPipes. A pattern for client/server communication via Named Pipes via C#

UnstoppableService. A pattern for a self-installing Windows service in C# with the unstoppable attributes in C#.

WMIProcessWatcher. An example pattern in C# for using WMI to monitor process creation and termination events.

DnsCache. C++

AntiDebug. PoC: Prevent a debugger from attaching to managed .NET processes via a watcher process code pattern.

WcfScan. A tool for scanning NET.TCP WCF endpoints to test the security of their binding configurations.

ActiveDirectoryServices. A more full featured C# API for connecting to and managing Active Directory (AD) and Lightweight Directory (AD-LDS) instances, complete with consumer application examples.

WidgetSender. Intentionally Vulnerable Demo App: .NET MVC, WCF, WebAPI, Web Forms

ChromePasswords. C

WhoDis. An example pattern in C# for watching security events (logon/logoff/privilege)

SneakyService. A simple, minimal C# windows service implementation that can be used to demonstrate privilege escalation from misconfigured windows services.

BlueScreenOnExit. PoC of a protected process causing a blue screen if killed.

RunAs. An example in C# for programmatically calling UAC to escalate to admin

CertCheck. Programmatically access a TLS certificate chain in C++ and C#

TLAD. The Totally Legit Authentication Dialog

DieHard. PoC: process watcher patterns to make killing a process hard.

ProtectProcessFromJoeUser. PoC: Protecting Joe User from killing his own process.

kata. A collection of breach and post-exploitation kata for the red teamer to constantly train to maintain proficiency.

LuhnForce. A C# tool for brute forcing Credit Card numbers with valid Luhn checks.

HeapSurf. A credit card memory scraper written in C#

Trojan-RetailDiagnostics. C#

BurpHmac. An HMAC authentication header plugin for Burp Proxy, written in Python.

PlanetExpressStockTracker. A silly little example how to trojan a C# windows app, as demonstrated at the southwest region CCDC competition.

readline. A Pure C# GNU-Readline like library for .NET/.NET Core

SpoofParentProcess. C++

taskkill. C++

netstat. C++

WindowsSessions. C++

CAPE. Malware Configuration And Payload Extraction

Internal-Monologue. Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS

SharpInvoke-SMBExec. SMBExec C# module

dns. A DNS library written in C#

screenshot. C++

OpenAutoruns. :shield: An open-source Windows autoruns viewer, as a course project (SJTU-IS405).

jarm. Python

HappySad. Sometimes you just need a Happy EXE and a Sad EXE

SunburstStrings. C#