Steve S.

Revenant. Revenant - A 3rd party agent for Havoc that demonstrates evasion techniques in the context of a C2 framework

InlineExecuteEx. A BOF that's a BOF Loader and more

Red_Team_Code_Snippets. random code snippets, useful for getting started

rdll-rs. A reflective DLL development template for the Rust programming language

ai-postex. Proof-of-concept implementation of AI-enabled postex DLLs

rssh-rs. Rust

T-70. A proof-of-concept shellcode loader that leverages AI/ML face recognition models to verify the identity of a user on a target system

emerald_template. A cmake template for crystal palace

scepter-rs. A hacky way of getting cross-arch/platform support in Cobalt Strike

T-1. T-1 is a shellcode loader that leverages ML techniques to detect VM environments

wiretap-rs. A vibe-coded port of wiretap

OffensiveRust. Rust Weaponization for Red Team Engagements.

ZeroTotal. A collection of source code, binaries, and compilation scripts designed to bypass detection

Abomination. A synergized Visual Studio and Rust development environment

athena-reader. A simple speed reading application that supports .txt, .pdf, and image text extraction

Cycotic. A python polymorphic engine for C programs

dll-rs. Rust template project for DLL development

sleepmask-clion. A simple Sleepmask BOF example

evading_the_machine. Source code for the worst malware classifier of all time

hiding_in_the_trees. evading a random forest classifier

binaryninja-ollama. Python

iris-rs. Rust

crackmes. Reverse engineering crackemes

Havoc_3rd_Party_Support. The Havoc Framework. Preserves Revenant and 3rd Party functionality to the maximum extent possible.

Drone. Rust

r77-rootkit. Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.

SpawnWith. C++

0xdarkvortex-MalwareDevelopment. This repo will contain code snippets for blogs: Malware on Steroids written by me at https://scriptdotsh.com/index.php/category/malware-development/

WindowSpy. WindowSpy is a Cobalt Strike Beacon Object File meant for automated and targeted user surveillance.

angr. Angr experimentation

vxlang-page. protector & obfuscator & code virtualizer

windows-defender. Malice Windows Defender AntiVirus Plugin

NtCreateUserProcess-Post. NtCreateUserProcess with CsrClientCallServer for mainstream Windows x64 version

CreateProcessInternalW-Full. Reimplement CreateProcessInternalW via Windows 10 20H1+/Windows 11 Base on NtCreateUserProcess-Post