Octoberfest7

TeamsPhisher. Send phishing messages and attachments to Microsoft Teams users

Inline-Execute-PE. Execute unmanaged Windows executables in CobaltStrike Beacons

MemFiles. A CobaltStrike toolkit to write files produced by Beacon to memory instead of disk

XLL_Phishing. XLL Phishing Tradecraft

OSEP-Tools. C#

DropSpawn_BOF. CobaltStrike BOF to spawn Beacons using DLL Application Directory Hijacking

zip_smuggling. Python3 utility for creating zip files that smuggle additional data for later extraction

DNS_Tunneling. DNS Tunneling using powershell to download and execute a payload. Works in CLM.

CVE-2023-36874_BOF. Weaponized CobaltStrike BOF for CVE-2023-36874 Windows Error Reporting LPE

Secure_Stager. An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution

SilentHarvest_BOF. A Cobalt Strike BOF implementation of the SilentHarvest registry dumping technique

KDStab. BOF combination of KillDefender and Backstab

BeatRev. POC for frustrating/defeating Malware Analysts

EventViewerUAC_BOF. Beacon Object File implementation of Event Viewer deserialization UAC bypass

Mutants_Sessions_Self-Deletion. Writeup of Payload Techniques in C involving Mutants, Session 1 -> Session 0 migration, and Self-Deletion of payloads.

enumhandles_BOF. C

Enumprotections_BOF. A BOF to enumerate system process, their protection levels, and more.

DSCourier_BOF. BOF POC of the DSCourier project / invoking WinGet via COM

Cohab_Processes. A small Aggressor script to help Red Teams identify foreign processes on a host machine

JumpSession_BOF. Beacon Object File allowing creation of Beacons in different sessions.

lnk_generator. Small project to facilitate creation of .lnk payloads

KillDefender_BOF. Beacon Object File implementation of pwn1sher's KillDefender

Presentations. Slide decks and/or materials from conference presentations

CS_Uploads_Tracker. Aggressor script add-in for CobaltStrike to track file uploads

Proxy_Egress_Persistence. A post-exploitation strategy for persistence and egress from networks utilizing authenticated web proxies

ThreadCPUAssignment_POC. A small experiment on assigning a processes threads a specific CPU and then blocking it with a high priority thread

KillDefender. A small (Edited) POC to make defender useless by removing its token privileges and lowering the token integrity

aggressor_snippets. A collection of random small Aggressor snippets that don't warrant their own repo

Backstab_BOF. Beacon Object File implementation of Yaxser's Backstab

Shoggoth. Shoggoth: Asmjit Based Polymorphic Encryptor

Octoberfest7.