Mariusz Banach

Penetration-Testing-Tools. A collection of more than 170+ tools, scripts, cheatsheets and other loots that I've developed over years for Red Teaming/Pentesting/IT Security audits purposes.

ThreadStackSpoofer. Thread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation from scanners and analysts.

PackMyPayload. A PoC that packages payloads into output containers to evade Mark-of-the-Web flag & demonstrate risks associated with container file formats. Supports: ZIP, 7zip, PDF, ISO, IMG, CAB, VHD, VHDX

ShellcodeFluctuation. An advanced in-memory evasion technique fluctuating shellcode's memory protection between RW/NoAccess & RX and then encrypting/decrypting its contents

cobalt-arsenal. My collection of battle-tested Aggressor Scripts for Cobalt Strike 4.0+

ProtectMyTooling. Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking, IOCs collection & PE Backdooring. You feed it with your implant, it does a lot of sneaky things and spits out obfuscated executable.

RedWarden. Cobalt Strike C2 Reverse proxy that fends off Blue Teams, AVs, EDRs, scanners through packet inspection and malleable profile correlation

decode-spam-headers. A script that helps you understand why your E-Mail ended up in Spam

Stracciatella. OpSec-safe Powershell runspace from within C# (aka SharpPick) with AMSI, Constrained Language Mode and Script Block Logging disabled at startup

ElusiveMice. Cobalt Strike User-Defined Reflective Loader with AV/EDR Evasion in mind

tomcatWarDeployer. Apache Tomcat auto WAR deployment & pwning penetration testing tool.

UnhookMe. UnhookMe is an universal Windows API resolver & unhooker addressing problem of invoking unmonitored system calls from within of your Red Teams malware

SharpWebServer. Red Team oriented C# Simple HTTP & WebDAV Server with Net-NTLM hashes capture functionality

AzureRT. AzureRT - A Powershell module implementing various Azure Red Team tactics

msidump. MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.

expdevBadChars. Bad Characters highlighter for exploit development purposes supporting multiple input formats while comparing.

VisualBasicObfuscator. Visual Basic Code universal Obfuscator intended to be used during penetration testing assignments.

Exploit-Development-Tools. A bunch of my exploit development helper tools, collected in one place.

RobustPentestMacro. This is a rich-featured Visual Basic macro code for use during Penetration Testing assignments, implementing various advanced post-exploitation techniques.

msi-shenanigans. Proof of Concept code and samples presenting emerging threat of MSI installer files.

PE-library. Lightweight Portable Executable parsing library and a demo peParser application.

procmon-filters. SysInternals' Process Monitor filters repository - collected from various places and made up by myself. To be used for quick Behavioral analysis of testing specimens. Inspired and based on Lenny Zeltser's collection.

HEVD_Kernel_Exploit. Exploits pack for the Windows Kernel mode driver HackSysExtremeVulnerableDriver written for educational purposes.

PhishingPost. PHP Script intdended to be used during Phishing campaigns as a credentials collector linked to backdoored HTML <form> action parameter

dirbuster. wfuzz, SecLists and john -based dirbusting / forceful browsing script intended to be used during web pentest assingments

burpContextAwareFuzzer. BurpSuite's payload-generation extension aiming at applying fuzzed test-cases depending on the type of payload (integer, string, path; JSON; XML; GWT; binary) and following encoding-scheme applied originally.

CustomXMLPart. A PoC weaponising CustomXMLPart for hiding malware code inside of Office document structures.

ntfs-journal-viewer. Utterly simple NTFS Journal dumping utility. Handy when it comes to Computer Forensics and Malware Forensics Ops.

digitalocean-app-redirector. Reverse-HTTP Redirector via DigitalOcean Apps Platform

LISET. Light System Examination Toolkit (LISET) - logs & activity & configuration gathering utility that comes handy in fast Windows incident response (either forensic or malware oriented).

EvilClippy. A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.

RPISEC-MBE-Solutions. Solutions to the RPISEC MBE / Modern Binary Exploitation VM & course.

PEInfo. Another Portable Executable files analysing stuff

prc_xchk. User-mode process cross-checking utility intended to detect naive malware hiding itself by hooking IAT/EAT.

wifi-arsenal. WiFi arsenal

unhook-bof. Remove API hooks from a Beacon process.

injectAllTheThings. Seven different DLL injection techniques in one single project.

OfficePurge. C#

mgeeky.

SharpWMI. SharpWMI is a C# implementation of various WMI functionality.

proxy2. HTTP/HTTPS proxy with custom plugins loading capability.

Phishious. An open-source Secure Email Gateway (SEG) evaluation toolkit designed for red-teamers.

o365enum. Enumerate valid usernames from Office 365 using ActiveSync, Autodiscover v1, or office.com login page.

CS-Remote-OPs-BOF. C

ScareCrow. ScareCrow - Payload creation framework designed around EDR bypass.

Havoc. The Havoc Framework

AQUARMOURY. My musings in C and offensive tooling

ssf. Secure Socket Funneling - Network tool and toolkit - TCP and UDP port forwarding, SOCKS proxy, remote shell, standalone and cross platform

C2concealer. C2concealer is a command line tool that generates randomized C2 malleable profiles for use in Cobalt Strike.

artifacts-kit. Pseudo-malicious usermode memory artifact generator kit designed to easily mimic the footprints left by real malware on an infected Windows OS.

SharpShooter. Payload Generation Framework

linux-utils. Some linux utils I've coded and decided to share.

Autorize. Automatic authorization enforcement detection extension for burp suite written in Jython developed by Barak Tawily in order to ease application security people work and allow them perform an automatic authorization tests

rpivot. socks4 reverse proxy for penetration testing

malleable-c2. Cobalt Strike Malleable C2 Design and Reference Guide

The-Hacker-Recipes. This project is aimed at freely providing technical guides on various hacking topics.

Bloodhound-Custom-Queries. Custom Query list for the Bloodhound GUI based off my cheatsheet

SharpHound. The BloodHound C# Ingestor

ADVobfuscator. Obfuscation library based on C++11/14 and metaprogramming

pinjectra. Pinjectra is a C/C++ OOP-like library that implements Process Injection techniques (with focus on Windows 10 64-bit)