ProcessusT

Processus's repositories

HEKATOMB

Hekatomb is a python script that connects to LDAP directory to retrieve all computers and users informations. Then it will download all DPAPI blob of all users from all computers and uses Domain backup keys to decrypt them.

Language:PythonGPL-3.0521 14 9

Venoma

Yet another C++ Cobalt Strike beacon dropper with Compile-Time API hashing and custom indirect syscalls execution

Language:C++197 9 6

Dictofuscation

Obfuscate the bytes of your payload with an association dictionary

Language:PythonGPL-3.070 20

UnhookingDLL

This script is used to bypass DLL Hooking using a fresh mapped copy of ntdll file, patch the ETW and trigger a shellcode with process hollowing

Language:C++69 4 1

PsNotifRoutineUnloader

This script is used to unload PsSetCreateProcessNotifyRoutineEx, PsSetCreateProcessNotifyRoutine, PsSetLoadImageNotifyRoutine and PsSetCreateThreadNotifyRoutine from ESET Security to bypass the driver detection

Language:C++63 30

SharpVenoma

CSharp reimplementation of Venoma, another C++ Cobalt Strike beacon dropper with custom indirect syscalls execution

Language:C#51 2 2

HavocHub

PoC for a Havoc agent/handler setup with all C2 traffic routed through GitHub. No direct connections: all commands and responses are relayed through Issues and Comments for maximum stealth.

Language:PythonGPL-3.03900

MasterKeyBrute

Bruteforce DPAPI encrypted MasterKey File from Windows Credentials Manager

Language:PythonGPL-3.022 1 1

EnumSSN

Enumerate SSN (System Service Numbers or Syscall ID) and syscall instruction address in ntdll module by parsing the PEB of the current process

Language:C++21 30

Automated-C2

Automate your C2 creation with Azure Frontdoor and randomly generated options

Language:PythonGPL-3.015 2 1

La-Gamelle

Tous les trucs utilisés dans les Tutos, les shellcodes, les templates, les notes...

Language:Python14 40

RemClip

RemClip is a C# project which permits to steal user clipboard data and send it to a remote web server under attacker control

Language:PHPGPL-3.013 2 2

LoadThatPE

A simple PE Loader tool that loads a PE from memory, decrypt it, resolve its imports, relocate its sections, and redefine its entry point to execute seamlessly from memory

Language:C++GPL-3.012 30

DetectEsetHooks

Tool to enumerate ESET hooked functions by parsing the ebehmoni.dll module

Language:C++9 20

MikNet

Autonomous red team implementation allowing sound capture and broadcast through an untraceable front-end server to the attacker's station

GPL-3.08 10

VolchockC2

VolchockC2 is a custom-built Command & Control (C2) framework, currently under active development. Designed for red team operations and adversary simulation, VolchockC2 focuses on flexibility, stealth, and efficient post-exploitation capabilities.

Language:PythonGPL-3.0700

IndirectSyscalls

A custom reimplementation of indirect syscalls without the use of GetModuleHandleA and GetProcAddress

Language:C++4 20

aspyco

Aspyco is a python script that permits to upload a local binary through SMB on a remote host. Then it remotely connects to svcctl named pipe through DCERPC to create and start the binary as a service.

Language:PythonGPL-3.03 10

CodeCaveInjection

Test d'injection de shellcode dans un fichier PE 64bits

Language:C++2 30

ESEDHOUND

ESEDHOUND is a python script that extract datatable from the ntds.dit file to retrieve users, computers and groups. The goal is to send all the infos into Bloodhound to help incident responders for identifying AD objects.

Language:PythonGPL-3.02 10