OffensiveDLR

OffensiveDLR Toolbox containing research notes & PoC code for weaponizing .NET's DLR Contents Script| Description ---|--- Kukulkan| A slimmed down version of SILENTTRINITY, C DLL & EXE that embed an IPY engine. Comms are encrypted and can be used with CobaltStrike Invoke-JumpScare.ps1| Executes...

ntqueueapcthreadex-ntdll-gadget-injection

🧪 NtQueueApcThreadEx NTDLL Gadget Injection Introduction This novel way of using NtQueueApcThreadEx by abusing the ApcRoutine and SystemArgument0-3 parameters by passing a random pop r32; ret gadget can be used for stealthy code injection. Within this PoC, the gadget in this case is picked random...

Sandman

Sandman Sandman is a backdoor that is meant to work on hardened networks during red team engagements. Sandman works as a stager and leverages NTP a protocol to sync time & date to get and run an arbitrary shellcode from a pre-defined server. Since NTP is a protocol that is overlooked by many...

bt2

bt2: Blaze Telegram Backdoor Toolkit bt2 is a Python-based backdoor in form of a IM bot that uses the infrastructure and the feature-rich bot API provided by Telegram, slightly repurposing its communication platform to act as a C&C. Dependencies Telepot requests Installation $ sudo pip install...

FlavorTown

FlavorTown Various ways to execute shellcode. C: Written/Tested using an empty project in VS 2022. C: Tested with VS 2022 and csc. MATLAB: Tested using MATLAB 2023a. These scripts require MATLAB to run. Usage: The usage can be found commented at the top of each file. Additionally, there's a basic...

CVE-2017-11882

CVE-2017-11882 43b original script from https://github.com/embedi/CVE-2017-11882 109b original script from https://github.com/unamer/CVE-2017-11882/ Kudos, now unamer's code can execute shellcode CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ MITRE...

canisrufus

CanisRufus A stealthy Python based Windows backdoor that uses Github as a command and control server. Requirements Python 2.x pygithub3 module PyCrypto module WMI module Enum34 module Netifaces module pypiwin32 module Features Encrypted transportation messages AES + SHA256 hashing Generate comput...

DEFCON-31-Syscalls-Workshop

Indirect Syscalls: A journey from high to low RedOps | Red Team Village | DEF CON 31 Getting Started All the theory and playbooks for the exercises can be found in the wiki, which together with the prepared POCs is the heart of this project. The POCs for the exercises can be found here on the mai...

go-shellcode

go-shellcode go-shellcode is a repository of Windows Shellcode runners and supporting utilities. The applications load and execute Shellcode using various API calls or techniques. The available Shellcode runners include: CreateFiber CreateProcess CreateProcessWithPipe CreateRemoteThread...

CVE-2018-17463

CVE-2018-17463 Working Proof of Concept Exploit for CVE-2018-17463 utilzing WebAssembly RWX Pages for Shellcode execution. CVE-2018-17463 stemmed from the incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64, allowing a remote attacker to execute arbitrary code inside a...

OffensiveCpp

OffensiveCpp Offensive C++ is a collection of offensive security snippets written in C++. It includes various tools for penetration testing and exploit development. Table of Contents OffensiveCpp Introduction Why C/C++? Compiling Reference Libraries Contributing License Introduction The purpose o...

maldev-for-dummies

Malware Development for Dummies In the age of EDR, red team operators cannot get away with using pre-compiled payloads anymore. As such, malware development is becoming a vital skill for any operator. Getting started with maldev may seem daunting, but is actually very easy. This workshop will sho...

php-reverse-shell

php-reverse-shell...

speakeasy

Speakeasy Speakeasy is a Windows malware emulation framework that executes binaries, drivers and shellcode in a modeled Windows runtime instead of a full VM. It emulates the Windows APIs, processes, threads, file system, registry and network that a sample uses, so the sample runs further than in ...

Win32_Offensive_Cheatsheet

Win32 Offensive Cheatsheet Win32 and Kernel abusing techniques for pentesters & red-teamers made by @UVision and @RistBS Dev mode enabled, open to any help : Windows Binary Documentation PE structure PE Headers Parsing PE Export Address Table EAT Resolve function address Import Address Table IAT...

CVE-2022-42475

CVE-2022-42475 Background This is the exploit for the blog post here: https://bishopfox.com/blog/exploit-cve-2022-42475 Redacted Version This version of the exploit will not work without you, the hacker, supplying the necessary memory addresses for ROP gadgets, etc. The work to determine these da...

malware-samples

Malware Samples This repository is intended to provide access to a wide variety of malicious files and other artifacts. All of the samples are in a password protected ZIP archive using a password of: infected Malware Analysis Exercises In addition to providing artifacts from samples, I will...

dicerosbicornis

DicerosBicornis A stealthy Python based Windows backdoor that uses email as a command and control server. Requirements Python 2.x PyCrypto module WMI module Enum34 module Netifaces module pypiwin32 module Features Encrypted transportation messages AES + SHA256 hashing Generate computer unique id...

gopher47

gopher47 A third-party Gopher Assassin for the Havoc Framework it's like the videogame :D What is This? 🤔 This is a 3rd Party agent for the Havoc C2 written in Golang, mainly written as a learning project, but I'm sure it's still useful. By the time this is out, you can read more about what and w...

CVE-2021-35211

Serv-U CVE-2021-35211 Exploit Potential for DoS - check your rules of engagement The exploit doesn't work every time, but it works enough that it will run shellcode in roughly 1 in every 5 or 6 runs. However, sometimes a failed exploit will crash the Serv-U server. Please ensure that your rules o...