winspy

WinSpy winspy : Creador de Backdoor para Reverse Shell de Windows con envenenador de IP Dependencias 1 - metasploit-framework 2 - xterm 3 - apache2 Instalación sudo apt-get install git git clone https://github.com/TunisianEagles/winspy.git cd winspy chmod +x setup.sh ./setup.sh chmod +x winspy.sh...

RPC-Triage

RPC-Triage Static vs dynamic, read this first. It is worth being clear about the line between dynamic and static analysis up front: this tool does its ranking purely through static analysis. It reads the compiled MIDL / NDR structures straight out of the binary and never executes anything. Static...

DetectRaptor

DetectRaptor A repository to share publicly available bulk Velociraptor detection content in an easy to consume way. Simply take the release VQL zip and import it into Velociraptor. This is made easy via the Velociraptor artifact exchange: Server.Import.DetectRaptor 1. Import Velociraptor Artifac...

ATTPwn

ATTPwn / || || || | || || \ | o || || || o | | || | | ||| |||| ||| /| | | || | | | | | | | | | | | ' || | | | | | | | | | | | \ / | | | ||| || || || // ||| ATTPwn is a computer security tool designed to emulate adversaries. The tool aims to bring emulation of a real threat into closer contact...

ad-honeypot-autodeploy

ad-honeypot-autodeploy Despliega un pequeño dominio de Windows, intencionadamente inseguro y vulnerable, para un RDP Honeypot de forma totalmente automática. Se ejecuta en virtualización autogestionada usando libvirt con QEMU/KVM pero se puede personalizar fácilmente para soluciones basadas en la...

ad-honeypot-autodeploy

ad-honeypot-autodeploy Deploy a small, intentionally insecure, vulnerable Windows Domain for RDP Honeypot fully automatically. Runs on self-hosted virtualization using libvirt with QEMU/KVM but it can be customized easily for cloud-based solutions. Used for painlessly set up a small Windows Domai...

Nim-RunPE

Nim-RunPE A Nim implementation of reflective PE-Loading from memory. The base for this code was taken from RunPE-In-Memory - which I ported to Nim. You'll need to install the following dependencies: nimble install ptrmath winim I did test this with Nim Version 1.6.2 only, so use that version for...

iMonitorSDK

中文 Introduction iMonitorSDK is a development kit that provides system behavior monitoring for endpoint and the cloud security. It is designed to help industrial applications such as security, endpoint management, and auditing can quickly implement necessary functions without worrying about the...

CVE-2024-49138-POC

CVE-2024-49138-POC Prueba de concepto que explota CVE-2024-49138 en CLFS.sys. CrowdStrike detectó la vulnerabilidad siendo explotada activamente por actores de amenazas. Probado en Windows 11 23h2. Hay un análisis exhaustivo disponible aquí. A continuación se muestran los hash de ntoskrnl.exe y...

pyrexecd

PyRexecd PyRexecd es un servidor SSH independiente para Windows. Características: Aplicación Win32 independiente no un servicio que reside en la bandeja del sistema. Soporta un solo usuario / autenticación solo con clave pública. Notifica conexiones entrantes mediante ventana emergente...

SirepRAT

SirepRAT - RCE as SYSTEM on Windows IoT Core SirepRAT Features full RAT capabilities without the need of writing a real RAT malware on target. Context The method is exploiting the Sirep Test Service that’s built in and running on the official images offered at Microsoft’s site. This service is th...

UAC_bypass_windows_store

UACbypasswindowsstore Windows 10 LPE UAC Bypass in Windows Store WSReset.exe uacbypassmod.c exe is fully automate. you don't need to run UAC.bat . registry method : https://github.com/sailay1996/FilelessUACbypassWSReset...

SharpToken

SharpToken Durante el movimiento lateral del equipo rojo, a menudo necesitamos robar los permisos de otros usuarios. Bajo la defensa de un EDR moderno, nos resulta difícil usar Mimikatz para obtener otros permisos de usuario, y si el usuario objetivo no tiene ningún proceso activo, no tenemos for...

attack_monitor

Monitor de Ataques Attack Monitor es una aplicación Python escrita para mejorar las capacidades de monitoreo de seguridad de estaciones de trabajo/servidores de Windows 7/2008 y todas las versiones posteriores y para automatizar el análisis dinámico de malware. Modos actuales mutuamente...

whids

IMPORTANTE: este README y otra documentación no están actualizados para reflejar los cambios realizados en las últimas versiones beta ya que ocurrieron muchos cambios. Todo esto se actualizará a su debido tiempo cuando se lance una versión estable consulte Hoja de ruta hasta la próxima versión...

whids

IMPORTANT: this README and other documentation is not updated to reflect the changes made to latest beta releases as a lot of changes happened. All this will be updated in time when a stable version will be released see Roadmap until next release. Feel free to run beta releases on your own and as...

AsmLdr

AsmLdr: A Dynamic Shellcode Loader for Windows x64 Overview AsmLdr is an advanced shellcode loader implemented in x64 assembly language, designed for Windows x64 environments. Its primary purpose is to execute encrypted payloads while minimizing detection by advanced antivirus software, endpoint...

creddump7

Información Este repositorio contiene mis modificaciones al programa original 'creddump' disponible en: https://code.google.com/p/creddump/ Yo no escribí el programa original. He combinado muchos parches y correcciones que he visto de diferentes foros y sugerencias de usuarios, además de modifica...

CVE-2023-21752

CVE-2023-21752 PoC for arbitrary file delete vulnerability in Windows Backup service. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21752 This repo contains two exploits: v1 - Just perform file delete of user choice v2 - Tries to abuse arb delete to spawn elevated cmd shell not...

FalconEye

FalconEye: Real-time detection software for Windows process injections FalconEye is a windows endpoint detection software for real-time process injections. It is a kernel-mode driver that aims to catch process injections as they are happening real-time. Since FalconEye runs in kernel mode, it...