SharpShooter

root@kitploit: / // / / // / / / \ / / / / \ / / / / / / / / / / / / // / / / // // / / / / // / // / // / / /// //,// / ./// /////// // Description SharpShooter is a payload creation framework for the retrieval and execution of arbitrary CSharp source code. SharpShooter is capable of...

ShellGhost

ShellGhost A memory-based evasion technique which makes shellcode invisible from process start to end. Motivation I wanted to share this shellcode self-injection POC to showcase some AV/EDR evasion concepts that may turn useful for Red Teaming. Just a few weeks ago I came up with a custom in-memo...

Cronos

...

MsfMania

MsfMania MsfMania is an advanced Python-based payload obfuscation framework designed to evade EDR/AV detection on Windows systems. It generates highly polymorphic executables through dynamic code generation, multi-layer encryption RC4, and binary metadata spoofing. ⚠️ Educational Purpose Only -...

demiguise

Demiguise - HTA encryption tool Released as open source by NCC Group Plc - http://www.nccgroup.trust/ Developed by Richard Warren, richard dot warren at nccgroup dot trust http://www.github.com/nccgroup/demiguise Released under AGPL, see LICENSE for more information What does it do? The aim of th...

demiguise

Demiguise - HTA 加密工具 由 NCC Group Plc 以开源形式发布 - http://www.nccgroup.trust/ 由 Richard Warren 开发, richard dot warren at nccgroup dot trust http://www.github.com/nccgroup/demiguise 基于 AGPL 发布，详见 LICENSE 文件 它的作用是什么？ 该项目的目标是生成.html文件，这些文件 包含一个加密的 HTA 文件 。其思路是，当目标访问页面时，获取密钥，并在浏览器中动态解密...

EmbedInHTML

Embed and hide any file in HTML Author: Arno0x0x - @Arno0x0x What this tool does is taking a file any type of file, encrypt it, and embed it into an HTML file as ressource, along with an automatic download routine simulating a user clicking on the embedded ressource. Then, when the user browses t...

Mistica

Mística --- Mística Logo by JoelGMSec Mística is a tool that allows to embed data into application layer protocol fields, with the goal of establishing a bi-directional channel for arbitrary communications. Currently, encapsulation into HTTP, HTTPS, DNS and ICMP protocols has been implemented, bu...

Christmas

Maldev Academy Maldev Academy Home Maldev Academy Syllabus Christmas Implementing an injection method mentioned by @Hexacorn. This PoC creates multiple processes, where each process performs a specific task as part of the injection operation. Each child process will spawn another process and pass...

ThunderShell

ThunderShell ThunderShell is a C RAT that communicates via HTTP requests. All the network traffic is encrypted using a second layer of RC4 to avoid SSL interception and defeat network detection on the target system. RC4 is a weak cipher and is used to help obfuscate the traffic. HTTPS options...

Ivy

THIS REPOSITORY HAS BEEN ARCHIVED To view the latest version of Ivy or to submit an issue, reference https://github.com/Tylous/Ivy. More Information If you want to learn more about the techniques utilized in this framework as well as the defensive measure to help defend against it, please take a...

cart

CaRT Compressed and RC4 Transport The CaRT file format is used to store/transfer malware and its associated metadata. It neuters the malware so it cannot be executed and encrypts it so anti-virus software cannot flag the CaRT file as malware. Advantages FAST: CaRT is just as fast as zipping a fil...

EmbedPayloadInPng

EmbedPayloadInPng Embed a payload within a PNG file by splitting the payload across multiple IDAT sections. Each section is encrypted individually using its own 16-byte key with the RC4 encryption algorithm. Quick Links Maldev Academy Home Maldev Academy Syllabus Maldev Academy Pricing...

Malicious code in webautomation_js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 854e679284d7396f5ac4f7248839fa3704a2c72bcec08c100267b5980cd2a0d5 index.js is packed with an obfuscator.io RC4 string-array plus self-defending debugger-check wrapper. The only exported function appends a...

CVE-2026-22093

The EVbee Service Android app uses TLS encrypted communication HTTPS, but does not validate the certificate provided by the server. This allows an attacker on the network path between the app and EVbee server to intercept and manipulate the communication between the app and server. The traffic is...

CVE-2026-22093 Adversary-in-the-Middle (AitM) attack vulnerability in EVbee Service app

The EVbee Service Android app uses TLS encrypted communication HTTPS, but does not validate the certificate provided by the server. This allows an attacker on the network path between the app and EVbee server to intercept and manipulate the communication between the app and server. The traffic is...

CVE-2026-22093

CVE-2026-22093 affects EVbee Service app (v1.4.101.00). The issue arises because the Android app performs TLS/HTTPS communication but does not validate the server certificate, enabling a man‑in‑the‑middle attacker on the network path to intercept and manipulate traffic. Additionally, the app is d...

FTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)

Fetch and execute an x86 payload from an FTP server. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP includ...

FTP Fetch, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)

Fetch and execute an x64 payload from an FTP server. Spawn a piped command shell Windows x64 staged. Connect back to the attacker Module Options...

FTP Fetch, Windows Upload/Execute, Bind TCP Stager (RC4 Stage Encryption, Metasm)

Fetch and execute an x86 payload from an FTP server. Uploads an executable and runs it staged. Listen for a connection Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...