kara-4search Goto Github PK

cve-2023-36168

An issue in AVG AVG Anti-Spyware v.7.5 allows an attacker to execute arbitrary code via a crafted script to the guard.exe component

danspecial

Weaponizing Gigabyte driver for priv escalation and bypass PPL

darkloadlibrary

LoadLibrary for offensive operations

dcmb

Dont Call Me Back - Dynamic kernel callback resolver.

deathsleep

A PoC implementation for an evasion technique to terminate the current thread and restore it before resuming execution, while implementing page protection changes during no execution.

deepspeed

DeepSpeed is a deep learning optimization library that makes distributed training and inference easy, efficient, and effective.

deepspeedexamples

Example models using DeepSpeed

defender-detectionhistory-parser

A parser of Windows Defender's DetectionHistory forensic artifact, containing substantial info about quarantined files and executables.

defendercheck

Identifies the bytes that Microsoft Defender flags on.

defenderstop

Stop Defender Service using C# via Token Impersonation

defenderyara

Extracted Yara rules from Windows Defender mpavbase and mpasbase

dfscoerce

dinvoke_shellcodeload_csharp

ShellCodeLoader via DInvoke

dirty-vanity

A POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.html#dirty-vanity-a-new-approach-to-code-injection--edr-bypass-28417

discover

Custom bash scripts used to automate various penetration testing tasks including recon, scanning, parsing, and creating malicious payloads and listeners with Metasploit.

domainborrowingc2

duedlligence

dumpert

LSASS memory dumper using direct system calls and API unhooking.

dynamicfinder

A DLL sideloading utility.

earlybirdinjection_csharp

Inject shellcode into process via "EarlyBird"

edr-telemetry

This project aims to compare and evaluate the telemetry of various EDR products.

edrs

evilclippy

A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.

evilginx2

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

excelntdonut

Excel 4.0 (XLM) Macro Generator for injecting DLLs and EXEs into memory.

fiber_shellcodeexecution

Using fibers to execute shellcode in a local process via csharp

flavortown

Various ways to execute shellcode

forkplayground

An implementation and proof-of-concept of Process Forking.

freeze

Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods

fulldllunhooking_csharp

Unhook DLL via cleaning the DLL 's .text section