ShellCodeEmulator

Windows shellcode emulation tool based upon unicorn framework. ShellcodeEmulator emulates Windows shellcode with the help of windbg process memory dumps. You can provide shellcode to analyze with any Windows process dump image. The tool will emulate as much as of the userland code using the...

Hawk

Hawk Silently intercept SSH and SU credentials in real-time Hawk monitors sshd and su processes, extracting passwords from memory via ptrace without modifying target processes. Zero writes. Pure read-only credential harvesting. Demo How It Works Hawk leverages Linux's /proc filesystem to discover...

Cohab_Processes

CohabProcesses This Aggressor script is intended to help internal Red Teams identify suspicious or foreign processes "Cohabitation" running in their environments. Red Teams may assemble a list of "known" processes either independently or in collaboration with Blue force and feed it to the aggress...

PhantomFS

PhantomFS ProjFS provider. Projects files where the content depends on which process reads them. Payload is stored AES-256-CBC encrypted on disk, decrypted only in memory at runtime. This shouldnt bypass any EDR as the payload will be written to disk when allowed processes try to read it...

vm2

vm2 !NPM Versionnpm-imagenpm-url !NPM Downloadsdownloads-imagedownloads-url !Licenselicense-imagelicense-url !Known Vulnerabilitiessnyk-imagesnyk-url vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Installation npm install vm2 Quick Examples import VM from...

processhacker-mcp

processhacker mcp this is dynamic mcp server for runtime analysis and process hacking. it is like processhacker but for ai agents. setup 1. open folder in visual studio it has cmakelists 2. build all ctrl+shift+b 3. it makes ProcessHackerMCP.exe and extensions/ folder. 4. run exe. it communicates...

RedPeanut

RedPeanut oooooooooooooooooo ooooooooooooooooooooooooooooooooooooooo ooooooooooooooooooooooooooooooooo ooooooooooooooooooooooooooooooooooooooooooo oooooooooooooooooooooooooooo oooooooooooooooooooooooooooooooooooooo RedPeanutv0.3.0@b4rtik Currently being tested. Known modules Issues: process -...

K55

K55 - Linux x8664 Process Injection Utility C++14 About K55 pronounced: "kay fifty-five" The K55 payload injection tool is used for injecting x8664 shellcode payloads into running processes. The utility was developed using modern C++11 techniques as well as some traditional C linux functions like...

juicy-potato

Juicy Potato abusing the golden privileges A sugared version ofRottenPotatoNG, with a bit of juice, i.e. another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM Summary RottenPotatoNG and its variants leverages the privilege escalation chain based on BITS...

VortexCry-Ransomware-Release

VortexCry-Ransomware VortexCry is an advanced ransomware that utilizes multi-stage process injection such as Process Hollowing and APC Injection and kernel driver loading via the CVE-2019-16098 vulnerability. It is capable of encrypting files, destroying system recovery functionalities, and...

p3-loader

P³-Shellcode Loader - Process Parameter Poisoning Authors: Max Hirschberger & Ogulcan Ugur Contents 1. Introduction 2. Typical Process Injection and Involved System APIs 3. Technical Foundation of Required Windows Internals 3.1 Process Creation API and Startup Parameters 3.2 The Process Environme...

RemoteTLSCallbackInjection

Maldev Academy - RemoteTLSCallbackInjection Quick Links Maldev Academy Home Maldev Academy Syllabus Related Maldev Academy Modules New Module 34: TLS Callbacks For Anti-Debugging New Module 35: Threadless Injection Overview This method utilizes TLS callbacks to execute a payload without spawning...

PyMemoryEditor

PyMemoryEditor A pure-Python library built on ctypes that lets you inspect, modify and search the memory of any running process in a few lines of Python — Cheat Engine workflows on Windows, Linux and macOS! Read, write and scan the memory of any process — straight from Python. One unified API...

PageTableInjection

PageTableInjection Code Injection, Inject malicious payload via pagetables pml4. Introduction This is just a proof-of-concept of the page table injection technique to inject malicious code into the arbitrary user processes. On Windowsand some modern OSes, every process has a its PML4 a.k.a...

proctools

proctools Small toolkit for extracting information and dumping sensitive strings from Windows processes . Made to accompany FormThief. procsearch - find sensitive strings in target process memory searches for parsed string in readable process memory, if found, displays a range of valid ASCII char...

Diamorphine

Diamorphine Diamorphine is a LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x x86/x8664 and ARM64 Features When loaded, the module starts invisible; Hide/unhide any process by sending a signal 31; Sending a signal 63to any pid makes the module become invisible; Sending a signal 64to any pid...

PPLBlade

PPLBlade Protected Process Dumper Tool that support obfuscating memory dump and transferring it on remote workstations without dropping it onto the disk. Key functionalities : 1. Bypassing PPL protection 2. Obfuscating memory dump files to evade Defender signature-based detection mechanisms 3...

psc

psc psc ps container is a fast process scanner that uses eBPF iterators and Google CEL to query system state with precision and full container context. Why psc? Fast Kernel-Level Access with eBPF Iterators psc uses eBPF iterators to read process and file descriptor information directly from kerne...

bat

Behavioral Adversary Tracer BAT BAT is a realistic, evolving adversary threat model for Linux and Windows. It is not a C2 framework and it is not a rootkit. It is a complete threat simulation platform that integrates C2 communication, kernel-level stealth rootkit modules, userspace evasion,...

pyradm

🔮 pyradm Remote administration crossplatfrom tool via telegram Coded with ❤️ python3 + aiogram3 https://t.me/whlab Screenshots Disclaimer All information contained in this repository is provided for educational and research purposes only The author is not responsible for any illegal use of this...