sm0n3p Goto Github PK

aceldr_adv_module_stomping

Cobalt Strike UDRL for memory scanner evasion.

bofryptor

bokuloader

A proof-of-concept Cobalt Strike Reflective Loader which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!

c2-tool-collection

A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techniques.

caro-kann

Encrypted shellcode Injection to avoid Kernel triggered memory scans

cobalt-arsenal

My collection of battle-tested Aggressor Scripts for Cobalt Strike 4.0+

cobalt-strike-profiles-for-edr-evasion

Cobalt Strike Profiles for EDR Evasion

cobaltwhispers

CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files (BOF) for Cobalt Strike to perform process injection, persistence and more, leveraging direct syscalls (SysWhispers2) to bypass EDR/AV

coercedpotatordll

Reflective DLL to privesc from NT Service to SYSTEM using SeImpersonateToken privilege

darkloadlibrary

LoadLibrary for offensive operations

edr-preloader

An EDR bypass that prevents EDRs from hooking or loading DLLs into our process by hijacking the AppVerifier layer

edrsilencer

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

elastic-container

Stand up a simple Elastic container with Kibana, Fleet, and the Detection Engine

elusivemice

Cobalt Strike User-Defined Reflective Loader with AV/EDR Evasion in mind

etwhash

C# POC to extract NetNTLMv1/v2 hashes from ETW provider

functionstomping

A new shellcode injection technique. Given as C++ header, standalone Rust program or library.

ghosttask

A tool employs direct registry manipulation to create scheduled tasks without triggering the usual event logs.

grimreaper

A improved memory obfuscation primitive using a combination of special and 'normal' Asynchronous Procedural Calls

hackbrowserdata

Decrypt passwords/cookies/history/bookmarks from the browser. 一款可全平台运行的浏览器数据导出解密工具。

injection

injectkit

Modified versions of the Cobalt Strike Process Injection Kit

interactive-execute-shellcode

A simple PoC of injection shellcode into a remote process and get the output using namepipe

ioctlhunter

kerbeus-bof

BOF for Kerberos abuse (an implementation of some important features of the Rubeus).

loudsunrun

Stack Spoofing with Synthetic frames based on the work of namazso, SilentMoonWalk, and VulcanRaven

malleable-c2

Cobalt Strike Malleable C2 Design and Reference Guide per CS Version

poolpartybof

A beacon object file implementation of PoolParty Process Injection Technique.

processstomping

A variation of ProcessOverwriting to execute shellcode on an executable's section

protections-artifacts

Elastic Security detection content for Endpoint

sharpghosttask

A C# port from Invoke-GhostTask