SharpWMI

SharpWMI SharpWMI is a C implementation of various WMI functionality. This includes local/remote WMI queries, remote WMI process creation through win32process, and remote execution of arbitrary VBS through WMI event subscriptions. Alternate credentials are also supported for remote methods...

Vulnerable-to-Debian-OpenSSL-bug-CVE-2008-0166

Search for BTC coins on earlier versions of Bitcoin Core with critical vulnerability OpenSSL 0.9.8 CVE-2008-0166 In this article, we will create a tool that will generate Bitcoin Addresses P2PKH using the CVE-2008-0166 vulnerability. This is a research project to find BTC coins on earlier version...

InjectProc

InjectProc Process injection is a very popular method to hide malicious behavior of code and are heavily used by malware authors. There are several techniques, which are commonly used: DLL injection, process replacement a.k.a process hollowing, hook injection and APC injection. Most of them use...

r77-rootkit

r77 Rootkit Fileless ring 3 rootkit r77 is a ring 3 rootkit that hides everything: Files, directories Processes & CPU/GPU usage Registry keys & values Services TCP & UDP connections Junctions, named pipes, scheduled tasks Hiding by prefix Everything that starts with "$77" is hidden. Configuration...

ProcessInjection

ProcessInjection The program is designed to perform process injection. Currently the tool supports 5 process injection techniques. 1 Vanilla Process Injection 2 DLL Injection 3 Process Hollowing 4 APC Queue 5 KernelCallbackTable Injection The tool accepts shellcode in 4 formats. 1 base64 2 hex 3 ...

sudo_inject

Linux Privilege Escalation by injecting process possessing sudo tokens Inject process that have valid sudo token and activate our own sudo token Introduction We all noticed that sometimes sudo doesn't ask us for a password because he remembers us. How does he remember us and how does he identifie...

b374k

b374k shell 3.2 This PHP Shell is a useful tool for system or web administrator to do remote management without using cpanel, connecting using ssh, ftp etc. All actions take place within a web browser Features : File manager view, edit, rename, delete, upload, download, archiver, etc Search file,...

CVE-2024-3094

CVE-2024-3094 CVE-2024-3094 is a critical security vulnerability discovered in the upstream tarballs of the xz utility, starting with version 5.6.0. This vulnerability involves malicious code that, through complex obfuscations, manipulates the build process of liblzma. What is this repo for? This...

TrueTree

TrueTree About Read all about the TrueTree concept here TrueTree is more than just a pstree command for macOS. It is used to display a process tree for current running processes while using a hierarchy built on additoinal pids that can be collected from the operating system. The standard process...

CVE-2026-102599

In Engine.IO versions 6.6.0 through 6.6.9, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored in the existing session. This allows a malicious client to establish a session and send an upgrade request with ...

dll-injector

About As the name suggests, the application primarily performs injecting a DLL into any process running on Windows. With the power of this, it is able to perform several operations on a process such as loading a DLL, unloading a DLL, and hooking primary WinAPI functions e.g., CreateFileW, ReadFil...

PoolParty

PoolParty A collection of fully-undetectable process injection techniques abusing Windows Thread Pools. Presented at Black Hat EU 2023 Briefings under the title - The Pool Party You Will Never Forget: New Process Injection Techniques Using Windows Thread Pools PoolParty Variants Variant ID| Varie...

SharpEDRChecker

SharpEDRChecker New and improved C Implementation of Invoke-EDRChecker. Checks running processes, process metadata, Dlls loaded into your current process and each DLLs metadata, common install directories, installed services and each service binaries metadata, installed drivers and each drivers...

shadow

shadow-rs 🦀 shadow-rs is a Windows kernel rootkit written in Rust, demonstrating advanced techniques for kernel manipulation while leveraging Rust’s safety and performance features. This project is intended for educational and research purposes. Table of Contents Notice Features Installation...

dlinject

dlinject.py Inject a shared library i.e. arbitrary code into a live linux process, without ptrace. Inspired by Cexigua and linux-inject, among other things. Usage .. . | /| | || || / | .. / | | | | |/ \ | |/ / \ \ \ | \ | |/|| /| |\ \ | /| // | / /| / / /|| / source:...

injectAmsiBypass

Cobalt Strike BOF - Inject AMSI Bypass Cobalt Strike Beacon Object File BOF that bypasses AMSI in a remote process with code injection. Running inject-amsiBypass BOF from CobaltStrike What does this do? 1. Use supplied PID argument to get a handle on the remote process hProc =...

apiscope

ApiScope ApiScope is a Windows x64 research tool for tracing selected API calls in a new or running process. It follows DLL load events through the Windows debugger API and installs hooks before the debuggee continues from each event. Included hooks: ntdll.dll!NtCreateFile records the target path...

NullGate

NullGate This project implements a comfortable and modern way to use the NTAPI functions using indirect syscalls, coupled with the FreshyCalls method with a little twist for dynamic syscall number retrieval. It also uses a technique that I haven't seen being mentioned to bypass windows defender's...

Enumprotections_BOF

Enumprotections BOF This BOF can be used to enumerate system processes and identify the protection level of each one. Additional information, like service relation, user, session, and path, are also returned. This information in combination can be used to identify good candidates to explore for...

windows-api-function-cheatsheets

Windows API Function Cheatsheets Contact 🌨️ Snowcrash: [email protected] Table of Contents Windows API Function Cheatsheets File Operations Process Management Memory Management Thread Management Dynamic-Link Library DLL Management Synchronization Interprocess Communication Windows Hooks...