malasada

malasada Donut for Linux, converts a Linux ELF shared object .so into a position-independent .bin blob that can be executed directly from memory for example, by copying it into an mmap'd region and jumping to it as a function pointer. This project intentionally avoids memfd memfdcreate, execveat ...

EXCELntDonut

| \ / / | | | | || \ | | | | \ / | | | | | | ' | | | | |/ | ' | | | | | | | / \ || || || | | | || || | | | | | || | | |//\|||| |||/ /|| ||,|| by @JoeLeonJr @FortyNorthSec EXCELntDonut is a XLM Excel 4.0 macro generator. Start with C source code EXE and end with a XLM Excel 4.0 macro that...

fireELF

fireELF fireELF is a opensource fileless linux malware framework thats crossplatform and allows users to easily create and manage payloads. By default is comes with 'memfdcreate' which is a new way to run linux elf executables completely from memory, without having the binary touch the harddrive...

Shellcode-Injection-Techniques

Shellcode Injection Techniques A collection of C shellcode injection techniques. All techniques use an AES encrypted meterpreter payload. I will be building this project up as I learn, discover or develop more techniques. Note: The project is not intended to be used as-is. If you are going to use...

Aladdin

Aladdin .-. .-''-., | //\ ";\ "/ \ , |'./ \ '='-, /\ \ || ///\ '. T |\ | /,-' '. '..-' /'/ | | '. .'-../ ,\ / '-' |/ /-----j .--..--'\ / --' '---. / '---. -'. .' .-- '. \ '--. ;.-o / '. /.8----' c-'----' Lefty @lefterispan - Nettitude Red Team - 2022 / 2023 About Aladdin is a payload generation...

Forblaze

Forblaze - A Python Mac Steganography Payload Generator/In-Memory Dylib/MachO Execution Author: AsaurusRex Disclaimer DO NOT use this project for purposes other than legitimate red teaming/pentesting jobs, or research. DO NOT use this for illegal activity of any kind, and know that this project i...

unicorn

unicorn Écrit par : Dave Kennedy @HackingDave Site web : https://www.trustedsec.com Magic Unicorn est un outil simple pour utiliser une attaque de rétrogradation PowerShell et injecter du shellcode directement en mémoire. Basé sur les attaques PowerShell de Matthew Graeber et la technique de...

nishang

Nishang Nishang est un framework et une collection de scripts et de payloads qui permet d'utiliser PowerShell pour la sécurité offensive, les tests de pénétration et le red teaming. Nishang est utile pendant toutes les phases des tests de pénétration. Par Nikhil Mittal Fondateur de Altered Securi...

java-stager

java-stager PoC Java Stager, который может загружать, компилировать и выполнять Java-файл в памяти. Только для исследовательских целей, не используйте там, где у вас нет разрешения. Что это? Основано на работе Джеймса Уильямса из его доклада «Next Gen AV vs My Shitty Code», доступного здесь:...

DexLoader

⚡Dex Loader Android This project demonstrates different methods of loading and executing DEX files in Android, with a focus on dynamic loading techniques such as DexClassLoader, PathClassLoader, and in-memory execution. 📦 Project Structure Dex Loader : Loads and executes contacts.dex, which...

chalumeau

Chalumeau Chalumeau est un outil automatisé, extensible et personnalisable de collecte d'identifiants basé sur powershell et python. Fonctionnalités principales Écrivez vos propres payloads Exécution en mémoire Extraire une liste de mots de passe Rapports sur tableau de bord / Interface web Analy...

CVE-2017-8759-exploits

CVE-2017-8759-exploits Two versions of CVE-2017-8759 exploits Example 1 - Downloads a .Net dll from a remote location without touching disk, loads and executes Example 2 - Loads an embedded .Net dll and executes...

Pyramid

Pyramid What is it Pyramid is composed of: 1. a Python HTTP/S server that can deliver encrypted files chacha, xor 2. Python modules that can load in-memory dependencies of offensive tooling such as Bloodhound-py, secretsdump, LaZagne, Pythonnet, DonPAPI, pythonmemorymodule, paramiko, pproxy. 3...

ibombshell

ibombshell - Dynamic Remote Shell ,--.!, / -- / / / // / / / / ,d08b. '| / / / / / \ / / / / / 0088MM / / // / // / / / / / / // // / / / / / / / 9MMP' ///// // //./// ///// + Starting the console... Console ready! ibombshell is a tool written in Powershell that allows you to have a prompt...

MoreImpacketExamples

MoreImpacketExamples This repository contains a few short python scripts that were created using the Impacket library. The primary goal of this project is to help myself and others who are looking to transition from using the provided impacket examples to modifying/creating scripts of their own...

awesome-game-security

awesome-game-security If you find that some links are not working, you can simply replace the username with gmh5225. Or you can send an issue for me. Show respect to all the projects below, perfect works of art 🫡 NeverC & NeverD — Your Compiler & Decoder for the AI Era As AI agents increasingly...

fileless-xec

➲ fileless-xec 🦜 👋 Certainement utile, principalement pour le fun, approximativement inspiré par l'article 0x00 article Utilisation en test d'intrusion : fileless-xec est utilisé sur la machine cible pour exécuter furtivement un fichier binaire situé sur la machine de l'attaquant ➲ Courte histoir...

HeaderLessPE

HeaderLessPE Introduction 中文 HeaderLessPE est une technique de chargement de PE en mémoire utilisée par le cheval de Troie Icedid. Basée sur cette technologie, nous proposons une nouvelle méthode d'attaque sans fichier utilisant HVNC. Cette amélioration permet d'injecter HeaderLessPE dans des...

EDRSilencer

EDRSilencer Inspired by the closed source FireBlock tool FireBlock from MdSec NightHawk, I decided to create my own version and this tool was created with the aim of blocking the outbound traffic of running EDR processes using Windows Filtering Platform WFP APIs. This tool offers the following...

No-Consolation

No-Consolation This is a Beacon Object File BOF that executes unmanaged PEs inline and retrieves their output without allocating a console i.e. spawning conhost.exe. Features Supports 64 and 32 bits Supports EXEs and DLLs Does not create new processes Does not create new threads Links modules to...