salemarsm Goto Github PK

hidefiles

hideprocess

A basic Direct Kernel Object Manipulation rootkit that removes a process from the EPROCESS list, hiding it from the Task Manager

infosec_reference

An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.

injdrv

proof-of-concept Windows Driver for injecting DLL into user-mode processes using APC

kdu

Kernel Driver Utility

kernel-dll-injector

Kernel-Mode Driver that loads a dll into every new created process that loads kernel32.dll module

kernelmode-manual-mapping-through-iat

Manual mapping without creating any threads, with rw only access

lazycopy

NTFS minifilter driver that can download file content from a remote location, when it is opened for the first time.

lightweight-reactive-snapshot-service

A Windows driver to protect against file-based crypto ransomware.

lvlchg

mecanikprocessbreaker

C++ POC Tool to inject process and RIP functions using NT SYSCALLS

minifilter-csharp-consoleapp

Permission Filesystem Minifilter

minilogger

This is a project that modified from Microsoft's minispy.

minivers

Windows file system minifilter driver which generates backup copies of certain files before they change

mirc

Old mIRC script used by SOD Team

multipotato

mydumbedr

nanodump

The swiss army knife of LSASS dumping

netspy

netspy是一款快速探测内网可达网段工具（深信服深蓝实验室天威战队强力驱动）

newinjectdrv

APC注入DLL内核层

no-defender

A slightly more fun way to disable windows defender. (through the WSC api)

nomorecookies

Browser Protector against various stealers, written in C# & C/C++.

offensivevba

This repo covers some code execution and AV Evasion methods for Macros in Office documents

pe-obfuscator

PE obfuscator with Evasion in mind

peloader

PE loader with various shellcode injection techniques

phdtemplate

Template for PhD theses at University of Wolverhampton

powershell-red-team

Collection of PowerShell functions a Red Teamer may use in an engagement

pplblade

Protected Process Dumper Tool

pplcontrol

Controlling Windows PP(L)s

ppldump

Dump the memory of a PPL with a userland exploit