AV-EDR-Killer

AV/EDR Killer https://github.com/user-attachments/assets/1eda3340-2af2-4136-b74e-be7a3f4b3924 This project demonstartes how a legit, and signed driver can be weponized to gain kernel level access. 🚨 The vulnerable driver: wsftprm.sys , signed by TPZ SOLUCOES DIGITAIS LTDA, and previously exposed ...

BadAssMacros

BadAssMacros Description Proof of Concept tool to generate malicious macros leveraging techniques like VBA Purging and Shellcode Obfuscation to evade AV engines. This tool takes in raw shellcode that can be generated by popular C2 frameworks like Metasploit,Cobalt Strike etc and outputs a VBA...

Shhhloader

Shhhloader Shhhloader is a work in progress shellcode loader. It takes raw shellcode as input and compiles a C++ stub that does a bunch of different things to try and bypass AV/EDR. The included python builder will work on any Linux system that has Mingw-w64 installed. 1/25/24 EDIT: Shhhloader no...

Ninja

Quick Update to include Follina Exploitation 01/06/2022 - NinjaC2 will generate the document and serve the HTML payload . More information : https://www.linkedin.com/posts/ahmed-khlief-499321a7i-just-pushed-a-quick-update-to-ninjac2-to-activity-6937661951007170560-Tmps Ninja V2.2 Released...

Skrull

Skrull Skrull is a malware DRM, that prevents Automatic Sample Submission by AV/EDR and Signature Scanning from Kernel. It generates launchers that can run malware on the victim using the Process Ghosting technique. Also, launchers are totally anti-copy and naturally broken when got submitted. It...

VEN0m-Ransomware

VEN0m Ransomware https://github.com/user-attachments/assets/5a1fc9b5-a647-41f6-a152-7b9d97381adc This project demonstartes how a legit, and signed driver can be weponized to evade defenses and deploy ransomware simulating a real cyberattack. 🚨 Tested on Windows 11 Pro 24H2. Fully undetectable as ...

Nimcrypt2

Nimcrypt2 Nimcrypt2 is yet another PE packer/loader designed to bypass AV/EDR. It is an improvement on my original Nimcrypt project, with the main improvements being the use of direct syscalls and the ability to load regular PE files as well as raw shellcode. Before going any further, I must...

OffensiveVBA

OffensiveVBA In preparation for a VBS AV Evasion Stream/Video I was doing some research for Office Macro code execution methods and evasion techniques. The list got longer and longer and I found no central place for offensive VBA templates - so this repo can be used for such. It is very far away...

hershell

Hershell Simple TCP reverse shell written in Go. It uses TLS to secure the communications, and provide a certificate public key fingerprint pinning feature, preventing from traffic interception. Supported OS are: Windows Linux Mac OS FreeBSD and derivatives Why ? Although meterpreter payloads are...

OffensiveRust

OffensiveRust My experiments in weaponizing Rust for implant development and general offensive operations. Table of Contents OffensiveRust Why Rust? Examples in this repo Compiling the examples Compiling the examples in this repo Cross Compiling Optimizing executables for size Pitfalls I found...

PythonMemoryModule

PythonMemoryModule pure-python implementation of MemoryModule technique to load a dll or unmanaged exe entirely from memory "Python memory module" AI generated pic - hotpot.ai What is it PythonMemoryModule is a Python ctypes porting of the MemoryModule technique originally published by Joachim...

acheron

About Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentatio...

CobaltWhispers

CobaltWhispers Author: @Cerbersec CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files for Cobalt Strike to perform process injection, persistence and more, leveraging direct syscalls to bypass EDR/AV. CobaltWhispers is powered by SysWhispers2 and InlineWhispers...

CarbonCopy

CarbonCopy A tool which creates a spoofed certificate of any online website and signs an Executable for AV Evasion. Works for both Windows and Linux Prerequisites In order to use it on Linux, please execute commands below: apt-get install osslsigncode pip3 install pyopenssl...

ShellGhost

ShellGhost A memory-based evasion technique which makes shellcode invisible from process start to end. Motivation I wanted to share this shellcode self-injection POC to showcase some AV/EDR evasion concepts that may turn useful for Red Teaming. Just a few weeks ago I came up with a custom in-memo...

hoaxshell

hoaxshell ⚡ The latest version of this project is the HoaxShell standalone listener which comes with refreshed payload templates. Wou can also use it directly from https://revshells.com make sure to choose hoaxshell as the listener. ⚠️ As of 2022-10-18, hoaxshell is detected by AMSI...

wmiexec-Pro

wmiexec-Pro New generation of wmiexec.py. Table of Contents 1. Info 2. Special thanks 3. Features 4. Getting Started Installation 5. Usage 6. Screenshots 7. How it works? 8. Disclaimer 9. References Info The new generation of wmiexec.py, more new features, whole the operations only work with port...

AsmLdr

AsmLdr: A Dynamic Shellcode Loader for Windows x64 Overview AsmLdr is an advanced shellcode loader implemented in x64 assembly language, designed for Windows x64 environments. Its primary purpose is to execute encrypted payloads while minimizing detection by advanced antivirus software, endpoint...

EXOCET-AV-Evasion

EXOCET - AV-evading, undetectable, payload delivery tool Chang Tan AWS Certified Cloud Practitioner and Solutions Architect Associate [email protected] Updated EXOCET Usage Make sure you pack your payloads to avoid any leaks of the crypter's key and further frustrate malware analysts. A...

ThreatCheck

ThreatCheck Modified version of Matterpreter's DefenderCheck. Takes a binary as input either from a file on disk or a URL, splits it until it pinpoints that exact bytes that the target engine will flag on and prints them to the screen. This can be helpful when trying to identify the specific bad...