SharpStay

SharpStay - .NET Persistence Building To compile open Visual Studio project and compile for release. Options Elevated Registry Keys Elevated UserInit Registry Key Elevated Scheduled Task Elevated Create Service Elevated WMI Event Subscription Non-Elevated InitMprLogonScript Registry Key...

doctrack

Doctrack Tool to manipulate and weaponize Office Open XML documents. Features Create Office Open XML documents Word, Excel Insert tracking pixels and UNC paths Remote Template injection Insert CustomXML parts Inspect external target URLs, metadata and Custom XML parts Installation You will need t...

donut

Current version: v1.1 Table of contents 1. Introduction 2. How It Works 3. Building 4. Usage 5. Subprojects 6. Developing with Donut 7. Questions and Discussions 8. Disclaimer 1. Introduction Donut is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL file...

DCOMIllusionist

🎩✨🪄 DCOMIllusionist Windows fileless lateral movement technique. Introduction • Build • Usage • Technical Details • Acknowledgements Introduction This tool enables remote code execution on a Windows machine, if you have administrative privileges. It leverages DCOM and the behavior of .NET DCOM...

EDD

CodeFactor EDD Enumerate Domain Data is designed to be similar to PowerView but in .NET. PowerView is essentially the ultimate domain enumeration tool, and we wanted a .NET implementation that we worked on ourselves. This tool was largely put together by viewing implementations of different...

SharpGPOAbuse

SharpGPOAbuse SharpGPOAbuse is a .NET application written in C that can be used to take advantage of a user's edit rights on a Group Policy Object GPO in order to compromise the objects that are controlled by that GPO. More details can be found at the following blog post:...

toxssin

toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...

msmap

MSMAP Msmap is a Memory WebShell Generator. Compatible with various Containers, Components, Encoder, WebShell / Proxy / Killer and Management Clients. 简体中文 The idea behind I, The idea behind II, The idea behind III Feature WIP Function Dynamic Menu Automatic Compilation Generate Script...

MemTracer

MemTracer MemTracer is a tool that offers live memory analysis capabilities, allowing digital forensic practitioners to discover and investigate stealthy attack traces hidden in memory. The MemTracer is implemented in Python language, aiming to detect reflectively loaded native .NET framework...

ChameleonMini-rebooted

ChameleonMini RevE - Rebooted Linux & OSX CI| Releases ---|--- | Attribution LICENSE "Based on the open-source NFC tool ChameleonMini: https://github.com/emsec/ChameleonMini" License This is firmware for the revised, rebooted version of the ChameleonMini RevE Rebooted which so many of you bought...

NixImports

NixImports A .NET malware loader, using API-Hashing and dynamic invoking to evade static analysis How does it work? NixImports uses my managed API-Hashing implementation HInvoke, to dynamically resolve most of it's called functions at runtime. To resolve the functions HInvoke requires two hashes...

DLLHijackHunter

DLLHijackHunter By ProjectMerai Automated DLL Hijacking Discovery, Validation, and Confirmation Turning local misconfigurations into weaponized, confirmed attack paths. Overview DLLHijackHunter is an automated Windows DLL hijacking detection tool that goes beyond static analysis. It discovers,...

wodat

wodat Windows Oracle Database Attack Tool Simple port of the popular Oracle Database Attack Tool ODAT https://github.com/quentinhardy/odat to C .Net Framework. Credit to https://github.com/quentinhardy/odat as lots of the functionality are ported from his code. Perform password based attacks e.g...

Blacklist3r

Blacklist3r The goal of this project is to accumulate the secret keys / secret materials related to various web frameworks, that are publicly available and potentially used by developers. These secrets will be utilized by the Blacklist3r tools to audit the target application and verify the usage ...

POSTDump

POSTDump Another tool to perform minidump of LSASS process using few technics to avoid detection. POSTDump is the C / .NET implementation of the ReactOS minidump function like nanodump, thus avoiding call to the Windows API MiniDumpWriteDump function. The dump logic code is saved under the...

SharpSecDump

SharpSecDump .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py. By default runs in the context of the current user. Please only use in environments you own or have permission to test against : Usage SharpSecDump.exe -target=192.168.1.15 -u=admin...

reko

reko - a general purpose decompiler. Reko Swedish: "decent, obliging" is a decompiler for machine code binaries. This project is freely available under the GNU General Public License. The project consists of front ends, core decompiler engine, and back ends to help it achieve its goals. A...

Covenant

Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers. Covenant is an ASP.NET Core, cross-platform application that includes a...

Brovan

Brovan "Emulate like a bro" - for your emulation services. Brovan is a powerful user-mode binary emulator for inspecting and running x8664 programs in a controlled emulated environment. It supports PE, ELF, memory dumps, and even raw files with no recognized file format. It is a tool used to...

HttpRemotingObjRefLeak

Leaking and Exploiting ObjRefs via HTTP .NET Remoting CVE-2024-29059 This repository provides further details and resources on the CODE WHITE blog post of the same name Leaking ObjRefs to Exploit HTTP .NET Remoting: 1. Creating a vulnerable ASP.NET web application 2. Detecting ObjRef leaks 3...