Justin Bui

DLLHijackTest. DLL and PowerShell script to assist with finding DLL hijacks

PrimaryTokenTheft. Steal a primary token and spawn cmd.exe using the stolen token

SharpClipboard. C# Clipboard Monitor

WhiteChocolateMacademiaNut. Interact with Chromium-based browsers' debug port to view open tabs, installed extensions, and cookies

UrbanBishopLocal. A port of FuzzySecurity's UrbanBishop project for inline shellcode execution

SwiftSpy. macOS keylogger, clipboard monitor, and screenshotter

SwiftInMemoryLoading. Swift implementation of in-memory Mach-O loading on macOS

TimeStomper. PoC that manipulates Windows file times using SetFileTime() API

LNKMod. C# project to create or modify existing LNKs

SK8RAT. C++ implant that interfaces with a SK8PARK server

ObjCShellcodeLoader. macOS shellcode loader written in Objective-C

SharpCrashEventLog. C# port of LogServiceCrash

DylibHijackTest. Discover DYLD_INSERT_LIBRARIES hijacks on macOS

SwiftParseTCC. Use "Full Disk Access" permissions to read the contents of TCC.db and display it in human-readable format

SK8PARK. Python 3 server used to control SK8RAT implant

SharpRoast-Parser. Bash one-liner that will parse harmj0y's SharpRoast or Rebeus kerberoast into hashcat crack-able format.

XORShellcodeLoader. Loads shellcode from a resource file.

SwiftLiverpool. Enumerate Location Services using CoreLocation API on macOS

pwnVNC. Python script that will attempt connection to unauthenticated VNC sessions on the entire Internet and take a screenshot of the user's current session.

SharpCryptUnprotectData. C#

C-Sharp-Out-Minidump. C# implementation of Out-Minidump.ps1

SwiftPlist. Partial rewrite of the `plutil` utility on macOS

MacDirtyCowDemo. Get root on macOS 13.0.1 with CVE-2022-46689 (macOS equivalent of the Dirty Cow bug), using the testcase extracted from Apple's XNU source.

LyncSniper. LyncSniper: A tool for penetration testing Skype for Business and Lync deployments

darling. Darwin/macOS emulation layer for Linux

log4j-honeypot-flask. Internal network honeypot for detecting if an attacker or insider threat scans your network for log4j CVE-2021-44228

RdpThief. Extracting Clear Text Passwords from mstsc.exe using API Hooking.

shad0w. Covert post exploitation framework

Pwdb-Public. A collection of all the data i could extract from 1 billion leaked credentials from internet.

MacHack. Hidden Tools in macOS

Debian8JessieSetup. Run on a fresh install of Debian 8 Jessie to create a new user, give sudo privileges, update your system, update your source list and more!

Advanced-Process-Injection-Workshop. C++

MiniShare-1.4.1-RCE. MiniShare 1.4.1 remote buffer overflow leading to RCE.

Priv2Admin. Exploitation paths allowing you to (mis)use the Windows Privileges to elevate your rights within the OS.

DelegationBOF. C++

inceptor. Template-Driven AV/EDR Evasion Framework

Havoc. The Havoc Framework

Crescendo. Crescendo is a swift based, real time event viewer for macOS. It utilizes Apple's Endpoint Security Framework.

macOSTools. macOS Offensive Tools

AceLdr. Cobalt Strike UDRL for memory scanner evasion.

Alaris. A protective and Low Level Shellcode Loader that defeats modern EDR systems.

geacon. Practice Go programming and implement CobaltStrike's Beacon in Go

Nidhogg. Nidhogg is an all-in-one simple to use rootkit for red teams.

FunctionStomping. A new shellcode injection technique. Given as C++ header or standalone Rust program.

nim_shellloader. nim,免杀,红队,shellcode,bypass,apt,bypass-av.

TestingDLL. TestingDLL using ShellExecuteA to spawn processes

frostbyte. FrostByte is a POC project that combines different defense evasion techniques to build better redteam payloads

1PasswordSuite. Utilities to extract secrets from 1Password

SwiftBelt. A macOS enumeration tool inspired by harmjoy's Windows-based Seatbelt enumeration tool.

XORcipher. Script will ask you to encrypt or decrypt a message by XORing the message with a OTP.