0xvm

SyscallPack

BOF and Shellcode for full DLL unhooking using dynamic syscalls

DInjector

Collection of shellcode injection techniques packed in a D/Invoke weaponized DLL

EDRs

MaldevAcademyLdr.1

riscy-business

RISC-V Virtual Machine

0xvm.github.io

acheron

indirect syscalls for AV/EDR evasion in Go assembly

APCLdr

Payload Loader With Evasion Features

AQUARMOURY

My musings in C and offensive tooling

AtomLdr

A DLL loader with advanced evasive features

c_syscalls

Single stub direct and indirect syscalling with runtime SSN resolving for windows.

CallBack

Execute Mimikatz in shellcode format, uses native API VirtualAlloc and EnumSystemGeoID

CLRvoyance

Managed assembly shellcode generation

concealed_code_execution

Tools and technical write-ups describing attacking techniques that rely on concealing code execution on Windows

hwbp4mw

ImmoralFiber

Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) PhantomThread (An evolved callstack-masking implementation)

impacket-static-binaries

Impacket static binaries, because you never know when you'll need them.

inteloops

Exploits Intel's signed iqvw64e.sys driver to allow manual mapping and read/writing of memory at a kernel level.

Jlaive-1

Antivirus evasion tool (crypter) that converts executables into undetectable batch files.

KrbRelayUp

KrbRelayUp - a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings).

offensive_c

OneBootloaderToLoadThemAll

One Bootloader to Load Them All - Research materials, Code , Etc.

OSED-Notes

Some notes + exercises that I've done during my study for the Offensive Security Exploit Developer.

osed-scripts

bespoke tooling for offensive security's Windows Usermode Exploit Dev course (OSED)

PatchlessInlineExecute-Assembly

Porting of BOF InlineExecute-Assembly to load .NET assembly in process but with patchless AMSI and ETW bypass using hardware breakpoint.

PE-Obfuscator

PE obfuscator with Evasion in mind

PINKPANTHER

Windows x64 handcrafted token stealing kernel-mode shellcode

process-cloning

The Definitive Guide To Process Cloning on Windows

vs-shellcode

Shellcode template for visual studio

WTSRM2