SysWhispers2

SysWhispers2 SysWhispers ayuda con la evasión generando archivos de encabezado/ASM que los implants pueden usar para hacer llamadas directas al sistema. Todas las llamadas al sistema principales son compatibles y hay archivos de ejemplo generados disponibles en la carpeta example-output/...

RingReaper

RingReaper RingReaper is a simple post-exploitation agent for Linux designed for those who need to operate stealthily, minimizing the chances of being detected by EDR solutions. The idea behind this project was to leverage iouring , the new asynchronous I/O interface in the Linux kernel,...

EDRPrison

EDRPrison Co-Author: @oops4githttps://github.com/oops4git EDRPrison leverages a legitimate WFP callout driver, WinDivert, to effectively silence EDR systems. Drawing inspiration from tools like Shutter, FireBlock, and EDRSilencer, this project focuses on network-based evasion techniques. Unlike i...

process-enumeration-stealth

🚴 process-enumeration-stealth What is this? This is a simple PoC which allows you to return a list of PIDs currently using NTFS, by querying the \ntfs\ base device the Windows filesystem base object. Using this method circumvents the need to use typical APIs, such as NtQuerySystemInformation or t...

OffensiveVBA

OffensiveVBA En preparación para un Stream/Video de Evasión AV con VBS, estaba investigando métodos de ejecución de código para Macros de Office y técnicas de evasión. La lista se hizo cada vez más larga y no encontré un lugar centralizado para plantillas VBA ofensivas, así que este repositorio...

kwetza

Introducción Por Chris Le Roy @brompwnie [email protected] Kwetza es una herramienta que permite infectar una aplicación Android existente con un payload de Meterpreter. ¿Qué hace? Kwetza infecta una aplicación Android existente con plantillas de payload personalizadas o predeterminadas para...

ExecIT

ExecIT Description DLL Shellcode self-inyector/runner based on HWSyscalls, ideally thought to be executed with rundll32. May grant fileless execution if victim endpoint has access to attacker-controlled SMB share. Usage root@kitploit: rundll32.exe ExecIT.dll, HelperFunc, Detection Currently it is...

rusty_drivers

RustyDrivers This project is a BYOVD collection with the focus on killing EDR / AV processes. Currently the following drivers are supported: Blocked means that the driver is in the block list of Microsoft and cannot be executed on an up to date Windows. Build root@kitploit: cargo build --release...

EchoDrv

EchoDrv Tool permitting to abuse Kernel read/write vulnerability in ECHOAC anti-cheat driver echodriver.sys Usage Example Sponsors I work at POST Luxembourg and thank them for allocating some time for me to develop and maintain this project! Visit POST website at...

EDRSilencer

EDRSilencer Inspired by the closed source FireBlock tool FireBlock from MdSec NightHawk, I decided to create my own version and this tool was created with the aim of blocking the outbound traffic of running EDR processes using Windows Filtering Platform WFP APIs. This tool offers the following...

BlackSnufkin

🎯 Profile Overview You have finally discovered my Github profile. Please feel free to clone/fork projects, raise issues and submit PRs if you think something could be better. Read my blog for write-ups and research - Happy Hacking! 😊 root@kitploit: struct OffensiveOperator handle: String, role:...

CallstackSpoofingPOC

Callstack spoofing + Indirect Syscalls POC This project consists of a simple C++ self-Injecting dropper focused on EDR evasion POC. To implement it, I have combined the use of Windows Thread Pooling to hide the call stack and the use of indirect syscalls to avoid hooking in the NTDLL...

Fireaway

FireAway-차세대 방화벽 우회 도구 v0.2 Fireaway는 차세대 방화벽의 레이어 7/AppID 검사 규칙과 데이터 손실 방지DLP, 애플리케이션 인식 프록시와 같은 기타 심층 패킷 검사 방어 메커니즘을 감사, 우회 및 데이터 유출exfiltration하기 위한 도구입니다. 이러한 전술은 NGFW가 레이어 7 데이터를 필터링하기 위해 연결을 설정하도록 허용해야 한다는 원칙과, 인터넷 서핑과 같은 정상 사용자 트래픽으로 위장하여 통신 채널을 방화벽 로그 내에 숨기기 위해 애플리케이션을 스푸핑spoofing하는 원칙에...

SelectMyParent

What's this This is a project for parent process spoofing. How to use step 1:Select a parent process and remember the pid Step 2:Execute the following command. Implement parent process spoofing root@kitploit: SelectMyParent.exe notepad 928 Step 3:Using process explorer to view the process tree, y...

SecML

SecML: A library for Secure and Explainable Machine Learning SecML is an open-source Python library for the security evaluation of Machine Learning ML algorithms. It comes with a set of powerful features: Wide range of supported ML algorithms. All supervised learning algorithms supported by...

Malleable-C2-Randomizer

Malleable-C2-Randomizer This script randomizes Cobalt Strike Malleable C2 profiles through the use of a metalanguage, hopefully reducing the chances of flagging signature-based detection controls. In short, the script parses the provided template, substitutes the variables for a random value from...

snuck

snuck 자동 XSS 필터 우회 개요 snuck은 주어진 XSS 필터를 효과적으로 테스트하기 위해 반영 컨텍스트를 기반으로 인젝션을 특화하는 자동화 도구입니다. 이 접근 방식은 Selenium을 사용하여 웹 브라우저를 구동함으로써 공격자와 피해자 모두의 행동을 재현합니다. snuck에 대해 알아보기 도구 및 사용자 가이드에 대한 자세한 내용은 튜토리얼을 방문하세요. 연구 논문 snuck의 방법론, 평가 및 구현은 기술 보고서에 설명되어 있습니다: Fabrizio d'Amore, Mauro Gentile: 자동 및 컨텍스트 인...

nim-loader

nim-loader un proyecto muy tosco y en progreso de aventura aprendiendo nim combinando recursos para crear un cargador de shellcode que implementa técnicas comunes de evasión de EDR/AV. ¡Esto es un desastre y es solo con fines de investigación! Por favor, no esperes que compile y se ejecute sin tu...

nim-loader

nim-loader a very rough work-in-progress adventure into learning nim by cobbling resources together to create a shellcode loader that implements common EDR/AV evasion techniques. This is a mess and is for research purposes only! Please don't expect it to compile and run without your own...

pickl3

Pickl3 Pickl3 es una herramienta de phishing de credenciales de usuario activo de Windows. Puedes ejecutar Pickl3 y realizar phishing de la credencial del usuario objetivo. Uso Operativo - 1 Hoy en día, dado que el sistema operativo de muchos usuarios finales es Windows 10, no podemos robar...