asaurusrex Goto Github PK

aceldr

Cobalt Strike UDRL for memory scanner evasion.

angryorchard

A kernel exploit leveraging NtUserHardErrorControl to elevate a thread to KernelMode and achieve arbitrary kernel R/W & more.

dlloader

doppelgate

DoppelGate relies on reading ntdll on disk to grab syscall stubs, and patches these syscall stubs into desired functions to bypass Userland Hooking.

foliage

Experiment on reproducing Obfuscate & Sleep

forblaze

Forblaze - A Python Mac Steganography Payload Generator

generate_dllproxy_header

Basic script to generate proxy DLL headers for side loading tests, will likely make prettier later

guard_comms

C2 Guard Comms code base based on Guard Pages

localdllparse

machobins

modified-tcc-clickjack

modified version of Ron Masas's TCC-Clickjack Swift project

parallelsyscalls

probatorum-edr-userland-hook-checker

Project to check which Nt/Zw functions your local EDR is hooking

rubicon

Caesar-Cipher based encryption

shellcodefluctuation

An in-memory evasion technique fluctuating shellcode memory protection between RW & RX and encrypting/decrypting contents

silent_chrome

This code shows how to silently install Web Store extensions on Google Chrome on MacOS

sleepycrypt

A shellcode function to encrypt a running process image when sleeping.

stardust

A modern 64-bit position independent implant template

string_spy

String Spy is a project aimed at improving MacOS/Linux defenses. It allows users to constantly monitor all running processes for user-defined strings, and if it detects a process with such a string it will log the PID, process path, and user running the process. It will also (optionally) kill the process.

tcc-clickjacking

A proof of concept for a clickjacking attack on macOS.

titanldr

Titan: A crappy Reflective Loader written in C and assembly for Cobalt Strike. Redirects DNS Beacon over DoH