1488 matches found
wasmforge
WasmForge WasmForge compiles Go and C programs to WebAssembly, then packages them as single native binaries. The resulting executables sandbox guest code inside a WASM runtime a per-build fork of wazero. From inside that sandbox, guests get transparent access to networking, raw sockets, Win32 API...
D1rkSleep
D1rkSleep Improved version of EKKO by @5pider that Encrypts only Image Sections. Sleep obfuscation technique that uses CreateTimerQueueTimer Win32 API. Credits: https://github.com/Cracked5pider/Ekko...
sshpass-win32
sshpass-win32 Like https://linux.die.net/man/1/sshpass Pre-Requirements To run sshpass, you must install: Windows 10 Insider build 17733 or later Install Winget winget install xhcoding.sshpass-win32 Scoop scoop install sshpass Usage Usage: sshpass options command arguments -h, --help show this he...
charlotte
charlotte c++ fully undetected shellcode launcher ; releasing this to celebrate the birth of my newborn description 13/05/2021: 1. c++ shellcode launcher, fully undetected 0/26 as of 13th May 2021. 2. dynamic invoking of win32 api functions 3. XOR encryption of shellcode and function names 4...
p-invoke.net
p-invoke.net This repository contains most of the P/Invoke definitions from the most-of-the-time offline pinvoke.net, adding the link to the Microsoft documentation for each one. The Gitbook is available at https://ricardojoserf.gitbook.io/pinvoke. Notes I did this to check some definitions in a...
CVE-2024-4577-checker
CVE-2024-4577 Vulnerability Checker The CVE-2024-4577 Vulnerability Checker is a Bash script designed to scan multiple domains for the CVE-2024-4577 vulnerability in PHP-CGI. This tool allows security researchers and system administrators to quickly assess whether their systems or a list of domai...
keebcap
Keebcap This repository contains the code associated to this article in which we talk about building a win32 keylogger that supports all languages not using input method editors. All tests were done on Windows 10 22h2. tree . keylog code ├── capgks.c sample keylogger using GetKeyState ├── capllh....
threadfire
threadfire Program uses Thread Hijacking to Inject Native Shellcode into a Standard Win32 Application. I was 15 years old when I made this - please ignore the substandard code. About I developed this small project to continue my experiences of different code injection methods and to allow RedTeam...
SneakyEXE
SneakyEXE /$$$$$$ /$$ /$$$$$$$$ /$$ /$$ /$$$$$$$$ /$$ $$ | $$ | $$/| $$ / $$| $$/ | $$ / /$$$$$$$ /$$$$$$ /$$$$$$ | $$ /$$ /$$ /$$| $$ | $$/ $$/| $$ | $$$$$$ | $$ $$ /$$ $$ | $$| $$ /$$/| $$ | $$| $$$$$ \ $$$$/ | $$$$$ \ $$| $$ \ $$| $$$$$$$$ /$$$$$$$| $$$$$$/ | $$ | $$| $$/ $$ $$ | $$/ /$$ \ $$|...
recomposer
Recomposer.py Ever have that not so safe feeling uploading your malware binaries to VirusTotal or other AV sites because you can look up binaries by hashes? Example: https://github.com/mubix/vt-notify Feel somewhat safer with Recomposer! Recomposer will take your binary and randomly do the...
staged-DLL-Injection-SMB-
staged-DLL-Injection Staged DLL injection proof-of-concept built in C using Win32 APIs — developed in an isolated lab environment for red team certification study CRTO. ⚠️ Disclaimer: This project was developed strictly in an isolated lab environment for educational purposes as part of offensive...
Exploit-Win32.CVE-2012-0158.F.doc
Exploit-Win32.CVE-2012-0158.F.doc the name of virus is the detection of microsoft defender, is the tipic antivirus...
DEFCON-31-Syscalls-Workshop
Indirect Syscalls: A journey from high to low RedOps | Red Team Village | DEF CON 31 Getting Started All the theory and playbooks for the exercises can be found in the wiki, which together with the prepared POCs is the heart of this project. The POCs for the exercises can be found here on the mai...
TokenPlayer
TokenPlayer Manipulating and Abusing Windows Access Tokens. TokenPlayer is just a small tool i made to learn win32 api programming and understand better the access token model of windows. Features: Stealing and Impersonating primary tokens. Impersonating Protected Processes. Bypassing UAC by usin...
thematrix
TheMatrix This project was created to ease the malware analysis process. The goal is to create an activator binary whose purpose is to load a user defined binary and monitor the execution by using Win32 API hooks. Relevant data is then saved to disk. The code supports both x86 and x64 binaries. D...
retrokit
retro-kit – reverse engineering old games headless Ghidra A toolkit for decompiling 32-bit games from roughly 1993–2010 with headless Ghidra: DOS LE/LX DOS/4GW, DOS/32A, PMODE/W, CauseWay, DOS/4G bind; also OS/2 LX and VxD built with Watcom C/C++ – with its own LE/LX loader for Ghidra and Watcom...
XeytanWin32-RAT
WARNING This is a buggy RAT, not completed, not stable. It still a "work in progress" application. Introduction Project created to kill some of my free time, It is not actively maintained. There are a lot of things to improve/fix, and it will take time to reach a stability on this project. Featur...
Win32_Offensive_Cheatsheet
Win32 Offensive Cheatsheet Win32 and Kernel abusing techniques for pentesters & red-teamers made by @UVision and @RistBS Dev mode enabled, open to any help : Windows Binary Documentation PE structure PE Headers Parsing PE Export Address Table EAT Resolve function address Import Address Table IAT...
CVE-2004-1561
CVE-2004-1561 Icecast Header Overwrite buffer overflow RCE Update for 568-edit.c Managed to get the original exploit to work. Edited according to this. Usage for 568-edit.c root@Kali:/TryHackme/Ice gcc 568-edit.c -o 568 root@Kali:/TryHackme/Ice ./568 192.168.92.133 Icecast = 2.0.1 Win32 remote co...