SysmonSimulator

SysmonSimulator SysmonSimulator is an Open source Windows event simulation utility created in C language, that can be used to simulate most of the attacks using WINAPIs. This can be used by Blue teams for testing the EDR detections and correlation rules. I have created it to generate attack data...

win-rat

win-rat Note: This repo is currently under testing.......soon will upload a fresh one. Virustotal Result: https://www.virustotal.com/gui/file/9fe32a10054b824b10cc24eb6ac1c96b5b8d4b3e730e4120c2a9891bc3d29a38/detection Contact: Telegram:- https://t.me/machine1337 Warning: Don't upload powershell or...

lifer

lifer A forensic tool for Windows link file examinations i.e. Windows shortcuts SYNOPSIS 'lifer' is a Windows or nix command-line tool inspired by the whitepaper 'The Meaning of Link Files in Forensic Examinations' by Harry Parsonage and available here. It started life as a lightweight tool that ...

TrustJack

TrustJack Yet another PoC for https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows Blogpost: https://redteamer.tips/?p=108 To be used with a cmd that does whatever the F you want, for a dll that pops cmd, https://github.com/jfmaes/CMDLL. check the list in wietze's site to check how you...

frida-wshook

frida-wshook frida-wshook is an analysis and instrumentation tool which uses frida.re to hook common functions often used by malicious script files which are run using WScript/CScript. The tool intercepts Windows API functions and doesn't implement function stubs or proxies within the targeted...

CVE-2019-0708

CVE-2019-0708 - BlueKeep RDP RDP Connection Sequence: https://docs.microsoft.com/en-us/openspecs/windowsprotocols/ms-rdpbcgr/023f1e69-cfe8-4ee6-9ee0-7e759fb4e4ee Analysis of RDP Service Vulnerability:...

CVE-2019-0708-poc

CVE-2019-0708 Big shout out to the Dox King Krebs and also the thief of inventions and all-purpose fraud, Kevin. https://www.youtube.com/watch?v=dQw4w9WgXcQ...

PKCS11SSHAgent

SRO PKCS11 – SSH Agent CNG Sovereign unification PKCS11 + SSH-agent + Pageant + CNG/Smartcard A single Windows executable that unifies four traditionally separate functions: Full PKCS11 module Firefox, OpenSC, ssh -I SSH agent compatible with OpenSSH/Git/VS/WSL Pageant server compatible with...

DbgShell

DbgShell A PowerShell front-end for the Windows debugger engine. Ready to tab your way to glory? For a quicker intro, take a look at Getting Started. Disclaimers 1. This project is not produced, endorsed, or monitored by the Windows debugger team. While the debugger team welcomes feedback about...

ATTPwn

ATTPwn / || || || | || || \ | o || || || o | | || | | ||| |||| ||| /| | | || | | | | | | | | | | | ' || | | | | | | | | | | | \ / | | | ||| || || || // ||| ATTPwn is a computer security tool designed to emulate adversaries. The tool aims to bring emulation of a real threat into closer contact...

CVE-2021-1675

CVE-2021-1675 / CVE-2021-34527 Impacket implementation of the PrintNightmare PoC originally created by Zhiniang Peng @edwardzpeng & Xuefeng Li @lxf02942370 Tested on a fully patched 2019 Domain Controller Execute malicious DLL's remote or locally Patch update Microsoft has released a patch to...

PenCrawLer

PenCrawLer An Advanced Web Crawler and DirBuster PeNCrawLer is an advanced webcrawler and dirbuster designed to use in penetration testing based on Windows Os. To read more about features please read the wiki: https://github.com/TheM4hd1/PenCrawLer/wiki...

CVE-2015-1578-PoC-Metasploit

CVE-2015-1578 Metasploit Module Overview This is a Metasploit module for CVE-2015-1578 , a buffer overflow vulnerability in Achat 0.150 beta7 on Windows. Exploitation leads to remote code execution via a crafted UDP packet. Purpose This module is designed to serve as a clean, minimal, and...

CFB

What is it? !CAUTION CFB is meant for research and debug purposes, it should never be used on production systems. Also BSoD may happen. You've been warned. Canadian Furious Beaver is a ProcMon-style tool designed only for capturing IRPs sent to any Windows driver. It operates in 2 parts: 1. the...

CVE-2023-36884-MS-Office-HTML-RCE

CVE-2023-36884: MS Office HTML RCE with crafted documents On July 11, 2023, Microsoft released a patch aimed at addressing multiple actively exploited Remote Code Execution RCE vulnerabilities. This action also shed light on a phishing campaign orchestrated by a threat actor known as Storm-0978,...

AoratosWin

AoratosWin AoratosWin is a tool that removes traces of executed applications on Windows OS which can easily be listed with tools such as ExecutedProgramList by Nirsoft. Feel free to decompile, reverse, redistribute, etc. Supported OS Tested On Windows 7 x86, x64 Windows 8 x86, x64 Windows 8.1 x86...

ThreatHound

ThreatHound ThreatHound is an advanced cybersecurity tool designed to facilitate efficient threat detection and analysis, windows events logs. it offers a user-friendly interface for managing and analyzing security data. Key features include log analysis, Sigma rule integration, and real-time...

ghost

ghost ghost is a light RAT that gives the server/attacker full remote access to the user's command-line interpreter cmd.exe. They are allowed to execute commands silently without the client/zombie noticing. The server/attacker is also given the ability to download and execute files on the...

CVE-2024-4577

CVE-2024-4577 - PHP CGI Argument Injection RCE Summary CVE-2024-4577 is a critical PHP CGI argument injection vulnerability that affects Windows systems running PHP in CGI mode. This flaw allows remote attackers to inject arguments into PHP's command line via specially crafted URLs, leading to...

racketeer

Racketeer Project - Ransomware simulation toolkit The goal of this project is to provide a way for teams to simulate and test detection of common ransomware operation, in a controlled manner, against a set of company assets and network endpoints. Deployment model The Racketeer toolkit operates on...