BANCOMAT's starred repositories
no-crt-template
simple c++ visual studio project that doesn't use the C/C++ runtime
EDR-Telemetry
This project aims to compare and evaluate the telemetry of various EDR products.
UltimateWDACBypassList
A centralized resource for previously documented WDAC bypass techniques
ThreadlessStompingKann
Combining 3 techniques (Threadless Injection + DLL Stomping + Caro-Kann) together to evade MDE.
httpworker
A Flask-based HTTP(S) command and control (C2) framework with a web interface. Custom Windows EXE/DLL implants written in C++. For educational use only.
.NetConfigLoader
.net config loader
LdrLockLiberator
For when DLLMain is the only way
Win32_Offensive_Cheatsheet
Win32 and Kernel abusing techniques for pentesters
EDRSandblast-GodFault
EDRSandblast-GodFault
CallStackMasker
A PoC implementation for dynamically masking call stacks with timers.
DEFCON-31-Syscalls-Workshop
Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".
ReflectiveNtdll
A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (using pe2shc by @hasherezade). Payload encryption via SystemFucntion033 NtApi and No new thread via Fiber
TimeException
A tool to find folders excluded from AV real-time scanning using a time oracle
AH2021Workshop
Malware development for red teaming workshop
ProtectMyTooling
Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking, IOCs collection & PE Backdooring. You feed it with your implant, it does a lot of sneaky things and spits out obfuscated executable.
PackMyPayload
A PoC that packages payloads into output containers to evade Mark-of-the-Web flag & demonstrate risks associated with container file formats. Supports: ZIP, 7zip, PDF, ISO, IMG, CAB, VHD, VHDX
Penetration-Testing-Tools
A collection of more than 170+ tools, scripts, cheatsheets and other loots that I've developed over years for Red Teaming/Pentesting/IT Security audits purposes.