LightsOut

LightsOut LightsOut will generate an obfuscated DLL that will disable AMSI & ETW while trying to evade AV. This is done by randomizing all WinAPI functions used, xor encoding strings, and utilizing basic sandbox checks. Mingw-w64 is used to compile the obfuscated C code into a DLL that can be...

PythonMemoryModule

PythonMemoryModule pure-python implementation of MemoryModule technique to load a dll or unmanaged exe entirely from memory "Python memory module" AI generated pic - hotpot.ai What is it PythonMemoryModule is a Python ctypes porting of the MemoryModule technique originally published by Joachim...

OffensiveRust

OffensiveRust My experiments in weaponizing Rust for implant development and general offensive operations. Table of Contents OffensiveRust Why Rust? Examples in this repo Compiling the examples Compiling the examples in this repo Cross Compiling Optimizing executables for size Pitfalls I found...

PEzor-Docker

PEzor-Docker With the help of this kali linux image, you can easily access PEzor on your system! Basically, this image is built from the kalilinux/kali-rolling image and then the PEzor shellcode and PE packer is installed on top of it. Sometimes, it's vital to have access to PEzor, specially in a...

Skrull

Skrull Skrull is a malware DRM, that prevents Automatic Sample Submission by AV/EDR and Signature Scanning from Kernel. It generates launchers that can run malware on the victim using the Process Ghosting technique. Also, launchers are totally anti-copy and naturally broken when got submitted. It...

Nimcrypt2

Nimcrypt2 Nimcrypt2 is yet another PE packer/loader designed to bypass AV/EDR. It is an improvement on my original Nimcrypt project, with the main improvements being the use of direct syscalls and the ability to load regular PE files as well as raw shellcode. Before going any further, I must...

PSSW100AVB

⚡ PSSW100AVB ⚡ PowerShell Detection Evasion & Sandbox Research PowerShell Scripts With 100% AV Bypass PSSW100AVB Repository...

TheFatRat

TheFatRat A Massive Exploiting Tool TheFatRat is an exploiting tool which compiles a malware with famous payload, and then the compiled maware can be executed on Linux , Windows , Mac and Android. Provides An Easy way to create Backdoors and Payload which can bypass most anti-virus...

zombie-zip

Zombie ZIP Técnica de confusión de formato ZIP que evade el 98 % de los motores antivirus. CVE-2026-0866 | VU976247 | Publicado el 10 de marzo de 2026 La técnica Crea un archivo ZIP donde: root@kitploit: Compression Method = 0 STORED Actual data = DEFLATE compressed CRC-32 = Checksum of...

CarbonCopy

CarbonCopy A tool which creates a spoofed certificate of any online website and signs an Executable for AV Evasion. Works for both Windows and Linux Prerequisites In order to use it on Linux, please execute commands below: root@kitploit: apt-get install osslsigncode pip3 install pyopenssl...

Java-Shellcode-Loader

Java ShellCode Loader Cargador de ShellCode implementado en Java, compatible con plataformas de 32 y 64 bits. El principio central es utilizar Jna para llamar a las API de Windows y lograr la inyección de shellcode. Entorno de ejecución: Jre = 1.5 Nota: este proyecto ya está integrado en el módul...

Salsa-tools

root@kitploit: / / / / / / / / \ / / / / / / / / / / / / / / // / // / / / / // / // / //,///,/ // //// Salsa Tools - An AV-Safe Reverse Shell dipped on bellota sauce Salsa Tools is a collection of three different tools that combined, allows you to get a reverse shell on steroids in any...

RustHound

This version is only compatible withBloodHound Legacy 4.x Version compatible withBloodHound Community Edition CE can be found here RustHound-CE. Summary Limitation Description How to compile it? Using Makefile Using Dockerfile Using Cargo Linux x8664 static version Windows static version from Lin...

BypassUAC

README This program is based on whitelist bypassuac. Using CS's AV-bypassing payload, you can directly get a session with UAC privileges. Usage: bypassuac.exe The demo effect is as follows whoami /priv as follows hashdump captures passwords as follows Bypass-AV Effect Windows Defender test passed...

hades

About Hades is a proof of concept loader that combines several evasion technques with the aim of bypassing the defensive mechanisms commonly used by modern AV/EDRs. Usage The easiest way, is probably building the project on Linux using make. root@kitploit: git clone https://github.com/f1zm0/hades...

hades

Acerca de Hades es un loader de prueba de concepto que combina varias técnicas de evasión con el objetivo de eludir los mecanismos defensivos comúnmente utilizados por los AV/EDR modernos. Uso La forma más sencilla es probablemente construir el proyecto en Linux usando make. root@kitploit: git...

acheron

Acerca de Acheron es una librería inspirada en SysWhisper3/FreshyCalls/RecycledGate, con la mayor parte de la funcionalidad implementada en ensamblador de Go. El paquete acheron se puede usar para añadir capacidades de syscall indirecta a tus herramientas ofensivas en Golang, para eludir AV/EDR q...

acheron

About Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentatio...

cve-2015-6612poc-forM

cve-2015-6612 POC for M reported by me and @WenXu from Keen put this under ANDROIDSRCROOT/frameworks/av/media/decrytpoc/ and cd into it && calling mm...

BadExclusionsNWBO

BadExclusions Now With Better Opsec BadExclusionsNWBO is an evolution from BadExclusions to identify folder custom or undocumented exclusions on AV/EDR. How it works? BadExclusionsNWBO copies and runs HookChecker.exe in all folders and subfolders of a given path. You need to have HookChecker.exe ...