Kara-4search's repositories
AddressOfEntryPoint_Hijack_CSharp
Shellcode injection or execution via AddressOfEntryPoint hijack.
CreateThreadpoolWait_ShellcodeExecution_CSharp
Shellcode execution via CreateThreadpoolWait with Csharp
PPLcontrol
Controlling Windows PP(L)s
ProjectPics
For temp pictures
AceLdr
Cobalt Strike UDRL for memory scanner evasion.
AlternativeShellcodeExec
Alternative Shellcode Execution Via Callbacks
capa
The FLARE team's open-source tool to identify capabilities in executable files.
CobaltStrike
CobaltStrike
CVE-2022-39197-patch
CVE-2022-39197 漏洞补丁. CVE-2022-39197 Vulnerability Patch.
DCMB
Dont Call Me Back - Dynamic kernel callback resolver.
DeathSleep
A PoC implementation for an evasion technique to terminate the current thread and restore it before resuming execution, while implementing page protection changes during no execution.
Dirty-Vanity
A POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.html#dirty-vanity-a-new-approach-to-code-injection--edr-bypass-28417
Freeze
Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods
goblin
一款适用于红蓝对抗中的仿真钓鱼系统
HackSysExtremeVulnerableDriver
HackSys Extreme Vulnerable Windows Driver
ImHex
🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
KDU
Kernel Driver Utility
KillDefender
A small POC to make defender useless by removing its token privileges and lowering the token integrity
physmem2profit
Physmem2profit can be used to create a minidump of a target hosts' LSASS process by analysing physical memory remotely
RedGuard
RedGuard is a C2 front flow control tool,Can avoid Blue Teams,AVs,EDRs check.
sgn_p
Shikata ga nai (仕方がない) encoder ported into go with several improvements
Shelltropy
A technique of hiding malicious shellcode via Shannon encoding.
Some_Pentesters_SecurityResearchers_RedTeamers
Some Pentesters, Security Researchers, Red Teamers which i learned from them a lot...
SourcePoint
SourcePoint is a C2 profile generator for Cobalt Strike command and control servers designed to ensure evasion.
Taskschedule-Persistence-Download-Cradles
Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged
vulnerability-write-ups
This repo contains write ups of vulnerabilities I've found and exploits I've publicly developed.