ProcessusT

Processus's repositories

HEKATOMB

Hekatomb is a python script that connects to LDAP directory to retrieve all computers and users informations. Then it will download all DPAPI blob of all users from all computers and uses Domain backup keys to decrypt them.

Language:PythonGPL-3.0447 12 8

ETWMonitor

Windows notifier tool that detects suspicious connections by monitoring ETW event logs

Language:PHP112 3 1

Venoma

Yet another C++ Cobalt Strike beacon dropper with Compile-Time API hashing and custom indirect syscalls execution

Language:C++98 5 3

PsNotifRoutineUnloader

This script is used to unload PsSetCreateProcessNotifyRoutineEx, PsSetCreateProcessNotifyRoutine, PsSetLoadImageNotifyRoutine and PsSetCreateThreadNotifyRoutine from ESET Security to bypass the driver detection

Language:C++62 30

UnhookingDLL

This script is used to bypass DLL Hooking using a fresh mapped copy of ntdll file, patch the ETW and trigger a shellcode with process hollowing

Language:C++58 3 1

vulnspy

VULNSPY regularly retrieves the latest alerts published by the CERT-FR and the related vulnerabilities with their CVSS score and allows you to notify by email or by discord if a defined threshold is exceeded

Language:PythonGPL-3.035 1 1

SharpVenoma

CSharp reimplementation of Venoma, another C++ Cobalt Strike beacon dropper with custom indirect syscalls execution

Language:C#31 10

Bypass-AV-DirectSyscalls

Scripts permettant de contourner la protection antivirale de Windows Defender via la technique de Direct Syscalls avec une injection de shellcode préalablement obfusqué avec un fonction XOR.

Language:C#25 1 1

CobaltStrikeBypassDefender

A launcher to load a DLL with xored cobalt strike shellcode executed in memory through process hollowing technique

Language:C++22 3 1

EnumSSN

Enumerate SSN (System Service Numbers or Syscall ID) and syscall instruction address in ntdll module by parsing the PEB of the current process

Language:C++19 20

La-Gamelle

Tous les trucs utilisés dans les Tutos, les shellcodes, les templates, les notes...

Language:Python13 40

RemClip

RemClip is a C# project which permits to steal user clipboard data and send it to a remote web server under attacker control

Language:PHPGPL-3.012 2 2

DetectEsetHooks

Tool to enumerate ESET hooked functions by parsing the ebehmoni.dll module

Language:C++8 10

MikNet

Autonomous red team implementation allowing sound capture and broadcast through an untraceable front-end server to the attacker's station

GPL-3.07 10

PayloadsAllTheThings

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Language:PythonMIT400

hacktricks

Welcome to the page where you will find each trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news.

Language:PythonNOASSERTION300

IndirectSyscalls

A custom reimplementation of indirect syscalls without the use of GetModuleHandleA and GetProcAddress

Language:C++3 10

AD-USERS-ENUM

Enumerate all users and their SID from LDAP

Language:Python2 20

invit-bomber

Script python permettant d'envoyer en masse des invitations sur LinkedIn

Language:Python2 10

Araneus

Je sais pas trop encore, on verra

Language:Python1 10

CodeCaveInjection

Test d'injection de shellcode dans un fichier PE 64bits

Language:C++1 20

Crowdsec_to_MISP

Simple Python script to extract suspicious IPs from Crowdsec sqlite database and inject them into your MISP

Language:Python1 30

ESEDHOUND

ESEDHOUND is a python script that extract datatable from the ntds.dit file to retrieve users, computers and groups. The goal is to send all the infos into Bloodhound to help incident responders for identifying AD objects.

Language:PythonGPL-3.01 10