injectAmsiBypass

Cobalt Strike BOF - Inject AMSI Bypass Cobalt Strike Beacon Object File BOF that bypasses AMSI in a remote process with code injection. Running inject-amsiBypass BOF from CobaltStrike What does this do? 1. Use supplied PID argument to get a handle on the remote process root@kitploit: hProc =...

BOF_ExecuteAssembly

BOF Execute-Assembly Beacon Object File for Cobalt Strike that executes .NET assemblies in beacon with evasion techniques. Overview Core Architecture root@kitploit: ┌──────────────────────────────────────────────────────────────────────────────┐ │ Cobalt Strike Beacon │ │ Parent Process │...

Nidhogg

Nidhogg Nidhogg is a multi-functional rootkit to showcase the variety of operations that can be done from kernel space. The goal of Nidhogg is to provide an all-in-one and easy-to-use rootkit with multiple helpful functionalities for operations. Besides that, it can also easily be integrated with...

nimcrypt

nimcrypt A Sliver shellcode loader written in Nim targeting Windows x64. Two variants covering the two most common delivery situations. Tested against Windows Defender with real-time protection enabled. Variants stager Reads an encrypted shellcode blob from disk, decrypts it in memory, and...

ThreatCheck

ThreatCheck Modified version of Matterpreter's DefenderCheck. Takes a binary as input either from a file on disk or a URL, splits it until it pinpoints that exact bytes that the target engine will flag on and prints them to the screen. This can be helpful when trying to identify the specific bad...

ExecuteAssembly

Description: ExecuteAssembly is an alternative of CS execute-assembly, built with C/C++ and it can be used to Load/Inject .NET assemblies by; reusing the host spawnto process loaded CLR Modules/AppDomainManager, Stomping Loader/.NET assembly PE DOS headers, Unlinking .NET related modules, bypassi...

Amsi-Bypass-Powershell

Sponsored by Amsi-Bypass-Powershell This repo contains some Antimalware Scan Interface AMSI bypass / avoidance methods i found on different Blog Posts. Most of the scripts are detected by AMSI itself. So you have to find the trigger and change the signature at the part via variable/function...

CheeseTools

CheeseTools This repository has been made basing onto the already existing MiscTool, so big shout-out to rasta-mouse for releasing them and for giving me the right motivation to work on them. CheeseExec Command Exec / Lateral movement via PsExec-like functionality. Must be running in the context ...

CVE-2022-25226

ThinVNC 1.0b1 - Authentication Bypass to Remote Code Execution CVE-2022-25226 Author: krill-x7 Reference: https://fluidattacks.com/advisories/sinatra Overview ThinVNC 1.0b1 contains an authentication bypass vulnerability CVE-2022-25226 allowing remote attackers to interact with the backend...

AMSI-patches-learned-till-now

Parches de AMSI aprendidos hasta ahora He documentado todos los parches de AMSI que he aprendido hasta ahora ❗ Mi aprendizaje de parches de AMSI hasta ahora. ¡No pertenece a los activos de mi empresa! DESCARGO DE RESPONSABILIDAD: ¡Este código no pretende ser evasivo hasta ahora! ¡Solo un enfoque...

AMSI.fail

AMSI.fail Originally C Azure Function Later ported to JS with an HTTP trigger that generates obfuscated PowerShell snippets that break or disable AMSI for the current process. The snippets are randomly selected from a small pool of techniques/variations before being obfuscated. Every snippet is...

InlineExecute-Assembly

InlineExecute-Assembly InlineExecute-Assembly is a proof of concept Beacon Object File BOF that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module. InlineExecute-Assembly will execute any...

py-amsi

py-amsi py-amsi is a library that scans strings or files for malware using the Windows Antimalware Scan Interface AMSI API. AMSI is an interface native to Windows that allows applications to ask the antivirus installed on the system to analyse a file/string. AMSI is not tied to Windows Defender...

GRAT2

GRAT2 C2 root@kitploit: c.-.c c.-.c c.-.c c.-.c c.-.c / .. \ / .. \ / .. \ / .. \ / .. \ \ Y / \ Y / \ Y / \ Y / \ Y / .-/'-'-..-/'-'-..-/'-'-..-/'-'-..-/'-'-. || G || || R || || A || || T || || 2 || .' -' '. .' -' '. .' -' '. .' -' '. .' -' '. .-./-'.-..-./-.-..-./-'.-..-./-'.-..-./-'.-...

NyxInvoke

NyxInvoke NyxInvoke es una herramienta versátil basada en Rust diseñada para ejecutar ensamblados .NET, comandos/scripts de PowerShell, Beacon Object Files BOFs y archivos PE, con capacidades integradas de desenganchado de Ntdll Ntdll Unhooking y evasión sin parches de AMSI y ETW. Puede compilars...

dropengine

por @s0lst1c3 Versión actual: v0.1.0-alpha Compatible con Python 3.7+. Descripción general Las técnicas de evasión de defensas tienden a tener una vida útil corta, y esto es especialmente cierto para las técnicas utilizadas durante el acceso inicial. Debido a esto, los payloads de acceso inicial ...

freddy

Freddy the Serialisation Killer - Deserialization Bug Finder A Burp Suite extension to aid in detecting and exploiting serialisation libraries/APIs. This useful extension was originally developed by Nick Bloor @nickstadb for NCC Group and is mainly based on the work of Alvaro Muñoz and Oleksandr...

wanderer

Wanderer Wanderer es un programa de código abierto que recopila información sobre los procesos en ejecución. Esta información incluye el nivel de integridad, la presencia de AMSI como módulo cargado, si se ejecuta en 64 o 32 bits, así como el nivel de privilegios del proceso actual. Esta...

wanderer

Wanderer Wanderer is an open-source program that collects information about running processes. This information includes the integrity level, the presence of the AMSI as a loaded module, whether it is running as 64-bit or 32-bit as well as the privilege level of the current process. This...

SharpBlock

SharpBlock A method of bypassing EDR's active projection DLL's by preventing entry point execution. Features Blocks EDR DLL entry point execution, which prevents EDR hooks from being placed. Patchless AMSI bypass that is undetectable from scanners looking for Amsi.dll code patches at runtime. Hos...