NorkNork

NorkNork - Tool for identifying Empire persistence payloads https://www.n00py.io/2017/01/removing-backdoors-powershell-empire-edition/ ABOUT: This script was designed to identify Powershell Empire persistence payloads on Windows systems. It currently supports checks for these persistence methods:...

progress-burp

Progress Tracker Burp Suite extension to track vulnerability assessment progress. Features Capturing items unique requests from the Burp Suite tools Proxy, Repeater, Target. Request unique key is defined as follows: target host, port, protocol, path and method. Items have following editable...

ContextMenuHijack

ContextMenuHijack This original idea that inspired me is from @NinjaParanoid : ContextMenuHijack is a simple persistence technique that use COM hijacking based on human behavior, when you right click on a file/folder in the File Explorer to open the Context Menu, it executes at the same time the...

Monitor

Project Description Used for implementing privilege persistence during the post-exploitation testing phase Project Usage Step 1 : Download the project, then compile Monitor.cpp using VS. Of course, you can also use the pre-compiled one. The Monitor.cpp code is as follows: include "Windows.h" int...

SharpHide

SharpHide Just a nice persistence trick to confuse DFIR investigation. Uses NtSetValueKey native API to create a hidden null terminated registry key. This works by adding a null byte in front of the UNICODESTRING key valuename. More info about this technique can be found in the following...

PANIX

PANIX - Persistence Against NIX PANIX is a powerful, modular, and highly customizable Linux persistence framework designed for security researchers, detection engineers, penetration testers, CTF enthusiasts, and more. Built with versatility in mind, PANIX emphasizes functionality, making it an...

SharpEventPersist

SharpEventPersist Persistence by writing/reading shellcode from Event Log. Usage The SharpEventPersist tool takes 4 case-sensitive parameters: -file "C:\path\to\shellcode.bin" -instanceid 1337 -source Persistence -eventlog "Key Management Service". The shellcode is converted to hex and written to...

no-defender

DMCA 08/06/24 This project was DMCA'd by some company, so all the releases, sources and everything else was wiped off, but if you still find my project useful or interesting, please leave a star 3. no-defender A slightly more fun way to disable windows defender. How it works There's a WSC Windows...

Session-Persistence-After-Enabling-2FA-CVE-2025-60425

Session Persistence After Enabling 2FA Overview The Nagios Fusion application version 2024R1.2 and 2024R2 contains a high security flaw where existing sessions remain valid even after enabling Two-Factor Authentication 2FA. Specifically, when 2FA is enabled for an administrator account, the...

TeamsImplant

TeamsImplant This project is a stealthy teams implant that proxies the urlmon.dll that teams uses compile and throw this bad boy in the teams directory as urlmon.dll and you got yourself a persistence backdoor whenever teams runs by a user or at startup. Features: Mutex so you don't get spammed...

Vidar-Stealer-Reverse-Engineering

Vidar Stealer 2.0 Reverse Engineering Analysis Overview This analysis covers an in-depth reverse engineering of Vidar Stealer 2.0 , a sophisticated information stealer that uses advanced evasion techniques to remain undetected. Key findings include: Task Scheduler Tampering: Modifies system task...

NoFaxGiven

NoFaxGiven - Code Execution & Persistence in NETWORK SERVICE FAX Service A fax routing extension is a DLL that adds routing functionality to the fax service. Multiple fax routing extensions can reside on one server. When the fax server receives a fax transmission, it routes the received document...

Palsy-Virus

Palsy Virus Python virus that will make your pc paralyzed once it opened ,hides itself and adds itself to the registry startup ^^ Platform : -- Windows only :P...

Trawler

Dredging Windows for Persistence What is it? Trawler is a PowerShell script designed to help Incident Responders discover potential indicators of compromise on Windows hosts, primarily focused on persistence mechanisms including Scheduled Tasks, Services, Registry Modifications, Startup Items,...

hermes-the-messenger

Hermes the messenger A PoC for achieving persistence via push notifications on Windows For more technical details and background read our blogpost here: https://www.persistent-security.net/post/beacon-on-demand-abusing-push-notifications-for-persistence Usage Before anything else you need to setu...

Fsociety-CVE-2024-0670-CheckMK-LPE

🚀 Fsociety-CVE-2024-0670-CheckMK-LPE - Powerful System Access Made Simple 📦 Overview Hello friend. This tool unlocks advanced access for CheckMK CVE-2024-0670. It takes advantage of weak file handling to gain SYSTEM support. The software includes a specialized persistence feature. It is developed...

fudshell

fudshell An efficent Script To Generate FUD Persistent Reverse Shell For Red Teaming. Don't Upload Generated Stub On Virustotal Warning: Don't Upload Any Payload On VirusTotal. If it get detected then let me know... i will update the stub. If u need cobalt strike evasions then DM on Telegram:...

Vegile

Vegile - Ghost In The Shell Vegile is a tool for Post exploitation Techniques in linux. Post Exploitation techniques will ensure that we maintain some level of access and can potentially lead to deeper footholds into our targets trusted network. Donate If this project is very helpful to your...

D3m0n1z3dShell

「😈」About D3m0n1z3dShell Demonized Shell is an Advanced Tool for persistence in linux. Install git clone https://github.com/MatheuZSecurity/D3m0n1z3dShell.git cd D3m0n1z3dShell chmod +x demonizedshell.sh sudo ./demonizedshell.sh One-Liner Install Download D3m0n1z3dShell with all files: curl -L...

burp_global_match_replace

Global Match & Replace GMR Burp Suite Extension Global Match & Replace GMR extends Burp Suite with match/replace rules to apply globally or across multiple tools of your choice Repeater, Intruder, Proxy, etc.. It provides per-request and response diffs so you can see exactly what changed. This...