process_overwriting

Process Overwriting Process Overwriting is a PE injection technique, closely related to Process Hollowing and Module Overloading. With its help, you can replace the main executable not a DLL of the target process. It works only for a newly created process - injection to existing processes is not...

netwatch

NetWatch Network diagnostics in your terminal. netwatch --view dense. Four boxes, no chrome, every keybind on a border. Download grows up from the axis, upload grows down. One binary, no config. sudo netwatch and you have live capture with L7 decode, process attribution where available, and a...

PPLBlade

PPLBlade Protected Process Dumper Tool that support obfuscating memory dump and transferring it on remote workstations without dropping it onto the disk. Key functionalities : 1. Bypassing PPL protection 2. Obfuscating memory dump files to evade Defender signature-based detection mechanisms 3...

Chrome-App-Bound-Encryption-Decryption

ChromElevator Chrome App-Bound Encryption Decryption 🚀 Overview A post-exploitation tool demonstrating a complete, in-memory bypass of Chromium's App-Bound Encryption ABE. This project utilizes Direct Syscall-based Reflective Process Hollowing to launch a legitimate browser process in a suspended...

TokenPlayer

TokenPlayer Manipulating and Abusing Windows Access Tokens. TokenPlayer is just a small tool i made to learn win32 api programming and understand better the access token model of windows. Features: Stealing and Impersonating primary tokens. Impersonating Protected Processes. Bypassing UAC by usin...

CVE-2023-21554-PoC

CVE-2023-21554-PoC CVE-2023-21554 Windows MessageQueuing PoC, analysis at https://www.zoemurmure.top/posts/cve202321554/ Before executing the PoC file, modify the target machine IP address manually. The sign of a successful PoC is the crash of the mqsvc.exe process. There is no pop-up information...

Skrull

Skrull Skrull is a malware DRM, that prevents Automatic Sample Submission by AV/EDR and Signature Scanning from Kernel. It generates launchers that can run malware on the victim using the Process Ghosting technique. Also, launchers are totally anti-copy and naturally broken when got submitted. It...

DetectWindowsCopyOnWriteForAPI

Windows Process Property Enumeration Tools for Threat Hunting Background The purpose of these tools is to enumerate traits of Windows processes that support the detection of process injection tradecraft used by threat actors. Tools d-cow - Windows Copy on Write Detector for shared Windows APIs e....

CryKeX

Properties: Cross-platform Minimalism Simplicity Interactivity Compatibility/Portability Application Independable Process Wrapping Process Injection Dependencies: Unix - should work on any Unix-based OS BASH - the whole script root privileges optional Limitations: AES and RSA keys only Fails most...

libpeconv

libPeConv A library to load and manipulate PE files. Objectives The goal of libPEConv was to create a "swiss army knife" for custom loading of PE files. It gathers various helper functions that you can quickly integrate in your own loader. For example: remapping sections, applying relocations,...

BIT-PARSE-2026-110854 Parse Server before 8.6.97 and 9.10.2 Denial of Service via Unhandled Email Error

Parse Server before 8.6.97 and 9.0.0 before 9.10.2 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verification email, or request a password reset while...

aes-finder

AES Finder Utility to find AES keys in running process memory. Works for 128, 192 and 256-bit keys. Usage Open aes-finder.sln solution in Visual Studio 2013 to compile source. Alternatively use gcc/clang: g++ -O3 -march=native -fomit-frame-pointer aes-finder.cpp -o aes-finder To search for keys i...

CVE-2026-82231 Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client

A Thrift client in Apache bRPC version 1.18.0, built with WITHTHRIFT which is off by default can be crashed by the server peer it talks to. When the server returns a TEXCEPTION reply whose exception struct is malformed, the client decodes it without catching what Apache Thrift throws...

KDU

KDU Kernel Driver Utility System Requirements x64 Windows 7/8/8.1/10/11; Administrative privilege is required. Purpose and Features The purpose of this tool is to provide a simple way to explore the Windows kernel/components without requiring extensive setup or a local debugger. It features:...

go-shellcode

go-shellcode go-shellcode is a repository of Windows Shellcode runners and supporting utilities. The applications load and execute Shellcode using various API calls or techniques. The available Shellcode runners include: CreateFiber CreateProcess CreateProcessWithPipe CreateRemoteThread...

insject

Insject insject is a tool for poking at containers. It enables you to run an arbitrary command in a container or any mix of Linux namespaces. It supports three main use-cases: LDPRELOAD-mode using libsetns.so LDPRELOAD=./libsetns.so SETNSARGS="..." Running a host command in a container insject...

Process-Dump

Process Dump Process Dump is a Windows reverse-engineering command-line tool to dump malware memory components back to disk for analysis. Often malware files are packed and obfuscated before they are executed in order to avoid AV scanners, however when these files are executed they will often...

link

link link is a command and control framework written in rust. Currently in beta. Table of Contents Introduction Features Feedback Build Process Acknowledgments Introduction link provides MacOS, Linux and Windows implants which may lack the necessary evasive tradecraft provided by other more matur...

GhostDriver

GhostDriver 👻 About GhostDriver is a Rust-built AV killer tool using BYOVD. Get Started 1. Install Rust from rust-lang.org 2. Clone: git clone https://github.com/BlackSnufkin/GhostDriver.git 3. Build: cargo build --release --target=x8664-pc-windows-msvc 4. Run: Execute the GhostDriver binary Usag...

ProcessInjection

ProcessInjection The program is designed to perform process injection. Currently the tool supports 5 process injection techniques. 1 Vanilla Process Injection 2 DLL Injection 3 Process Hollowing 4 APC Queue 5 KernelCallbackTable Injection The tool accepts shellcode in 4 formats. 1 base64 2 hex 3 ...