OffensiveVBA

OffensiveVBA In preparation for a VBS AV Evasion Stream/Video I was doing some research for Office Macro code execution methods and evasion techniques. The list got longer and longer and I found no central place for offensive VBA templates - so this repo can be used for such. It is very far away...

BrokenFlow

BrokenFlow A simple PoC to invoke an encrypted shellcode by using an hidden call. Introduction This code uses a simple trick to hide the instruction that effectively will jump to our shellcode. This should make the static analysis or emulation more challenging. As always, if this concept was...

hades

About Hades is a proof of concept loader that combines several evasion technques with the aim of bypassing the defensive mechanisms commonly used by modern AV/EDRs. Usage The easiest way, is probably building the project on Linux using make. git clone https://github.com/f1zm0/hades && cd hades ma...

Chaya

Chaya Right To Privacy Chaya protects your privacy through steganography, cryptography and compression. It effectively encrypts your payloads using AES-256-GCM cryptography, embeds them using LSB-LPS steganography technique into images and compresses them using FLIF to evade detection by performi...

Ghost-In-The-Logs

Ghost In The Logs This tool allows you to evade sysmon and windows event logging, my blog post about it can be found here Usage You can grab the lastest release here Starting off Once you've got the latest version execute it with no arguments to see the avalible commands $ gitl.exe Loading the ho...

SilentButDeadly

SilentButDeadly Overview SilentButDeadly is a network communication blocker specifically designed to neutralize EDR/AV software by preventing their cloud connectivity using Windows Filtering Platform WFP. This version focuses solely on network isolation without process termination. Blog:...

AceLdr

AceLdr - Avoid Memory Scanners A position-independent reflective loader for Cobalt Strike. Zero results from Hunt-Sleeping-Beacons, BeaconHunter, BeaconEye, Patriot, Moneta, PE-sieve, or MalMemDetect. Features Easy to Use Import a single CNA script before generating shellcode. Dynamic Memory...

Armor

Armor Armor is a simple Bash script designed to create encrypted macOS payloads capable of evading antivirus scanners. Below is an example gif of Armor being used with a simple Netcat payload. A Netcat listener is started on port 4444. The "payload.txt" file is read and shown to contain a simple...

Awesome-WAF

Awesome WAF Everything about web application firewalls WAFs from a security perspective. 🔥 Foreword: This was originally my own collection on WAFs. I am open-sourcing it in the hope that it will be useful for pentesters and researchers out there.As the saying goes, "the community just learns from...

VBoxCloak

VBoxCloak A PowerShell script that attempts to help malware analysts hide their VirtualBox Windows VM's from malware that may be trying to evade analysis. Guaranteed to bring down your pafish ratings by at least a few points ; The script accomplishes this by doing the following: Renames several...

MultiDump

MultiDump MultiDump is a post-exploitation tool written in C for dumping and extracting LSASS memory discreetly, without triggering Defender alerts, with a handler written in Python. Blog post: https://xreous.io/posts/multidump MultiDump supports LSASS dump via ProcDump.exe or comsvc.dll, it offe...

DefenderCheck

DefenderCheck Quick tool to help make evasion work a little bit easier. Warning: As of the 1.337.157.0 Defender signature update, DefenderCheck is classified as VirTool:MSIL/BytzChk.C!MTB. As a workaround while I work to get around this, please disable Real-time Protection in Defender before...

ASWCrypter

Welcome to the ASWCrypter script v1.0 100% FUD An Bash&Python Script For Generating Payloads that Bypasses All Antivirus so far FUD ; . PLEASE DON'T UPLOAD BACKDOOT TO WWW.VIRUSTOTAL.COM 23/08/2018 Important This Version Just for test , In future I will update ASWCrypter to generate a payloads fo...

slipstream

NAT Slipstreaming NAT Slipstreaming を使用すると、攻撃者は被害者のNAT/ファイアウォールをバイパスして（リモート任意ファイアウォールピンホール制御）、被害者がWebサイトを訪問するだけで、被害者のNATの背後にある任意のシステム にバインドされた任意のTCP/UDPサービスにリモートアクセスできます。 v1 開発者 : @SamyKamkar // https://samy.pl v2 開発者 : Samy Kamkar && Ben Seri && Gregory Vishnipolsky、Armis 所属 詳細はBen & Gregory による...

Salat-Stealer-Telegram-Proxy-Decoy-C2-Analysis

1. Telegramプロキシのデコイ – 偽装と回避 実行されると、Salat Stealerは完全に機能するTelegram Proxy インターフェースを表示します。このデコイは、ユーザーを正当なプロキシアプリケーションを実行していると思わせるためのカモフラージュとして機能し、その間マルウェアはバックグラウンドで悪意のある操作を実行します。 主な観察結果: インターフェース: ウィンドウは正当なTelegramプロキシクライアント（proxy.telegram.org）を模倣しています。 ポート: 通常のトラフィックに紛れるためにポート443（標準HTTPSポート）を使用します。...

lutlol

Living Under the Land on Linux 同名のトークの資料: BSides Belfast 2025 BSides Vienna 2025 このコードはそのままでは特に使い物になりませんが、参考にはなるかもしれません。 役立つもの: src/ ディレクトリ - トーク内のほとんどのもののソースコード ProcrastinationEDR - おそらく世界最悪の EDnot reallyR Sneaky Remap - 隠すためのもの Anime Costume Cheese - 注入可能な共有オブジェクトファイル Kas-playing as Curl in a...

ZipExec

ZipExec ZipExec is a Proof-of-Concept POC tool to wrap binary-based tools into a password-protected zip file. This zip file is then base64 encoded into a string that is rebuilt on disk. This encoded string is then loaded into a JScript file that when executed, would rebuild the password-protected...

EDRs

EDRs このリポジトリには、レッドチーム演習中に役立つ可能性のあるEDRに関する情報が含まれています。 patchsyscalldynamically64.c このPoCは、syscall IDを動的に解決するため、リモートホスト上で実行されているバージョンを確認する必要がありません。ディスク上（改ざんされていない）の情報を取得するために、CreateFileMappingおよびMapViewOfFile Windows APIの呼び出しが実行されます。その後、DLLが解析されてデータが取得され、ライブコードのパッチに使用されます。 patchsyscall64.c...

CVE-2023-36003

CVE-2023-36003: Windows Defender Exploit Protection バイパス PoC このリポジトリには、CVE-2023-36003 の Proof of Concept（PoC）が含まれています。これは、Windows Defender Exploit Protection に影響を与える、重要なセキュリティ機能バイパス脆弱性です。 概要 CVE-2023-36003 は Windows Defender...

DarkWidow

DarkWidow A Customizable Dropper Tool targeting Windows. Honourable Mentions: 1. BlackHat Asia, 2024 - Call For Tools 2. BlackHat USA, 2024 - Call For Tools 3. BlackHat SecTor, 2024 - Call For Tools 4. BlackHat Europe, 2024 - Call For Tools 5. Wild West Hacking Fest 2024 - Arsenal Thanks a lot to...