endymi's repositories
Jicop-H00k
contains the core files required to create a Beacon Object File (BOF) for use with AM0N-Eye. BOFs are compiled C programs written in a specific convention that allows them to execute within a Beacon process and use internal Beacon APIs. BOFs provide a fast and efficient way to extend the Beacon
SharpShares
Multithreaded C# .NET Assembly to enumerate accessible network shares in a domain
Mockingjay_BOF
Cobalt Strike + Brute Ratel C4 Beacon Object File (BOF) Conversion of the Mockingjay Process Injection Technique
C2-Tool-Collection
A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techniques.
DeepFaceLab
DeepFaceLab is the leading software for creating deepfakes.
EnableWebDAVClient-BOF
Cobalt Strike Beacon Object File to enable the webdav client service on x64 windows hosts
GATOR
GATOR - GCP Attack Toolkit for Offensive Research, a tool designed to aid in research and exploiting Google Cloud Environments
badger-builder
badger-builder is an AI-assisted tool for generating dynamic Brute Ratel C4 profiles
ScreenshotBOF
An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot downloaded in memory.
WdToggle
A Beacon Object File (BOF) for Cobalt Strike which uses direct system calls to enable WDigest credential caching.
PrivKit
PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS.
BOF-DCOMPotato-PrintNotify
Cobalt Strike Beacon Object File (BOF) that obtain SYSTEM privilege with SeImpersonate privilege by passing a malicious IUnknwon object to DCOM call of PrintNotify.
non-ms-binaries
Code snippet to create a process using the "PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON" flag
whereami
Cobalt Strike Beacon Object File (BOF) that uses handwritten shellcode to return the process Environment strings without touching any DLL's.
xPipe
Cobalt Strike BOF to list Windows Pipes & return their Owners & DACL Permissions
BOFs-snov
Beacon Object Files (not Buffer Overflows)
ServiceSetSD-Bof
Beacon Object file set service sd
BOF-RemoteRegSave
Cobalt Strike Beacon Object File (BOF) that uses RegConnectRegistryA + RegOpenKeyExA API to dump registry hives on remote computer
BOF-SprayAD
Cobalt Strike Beacon Object File (BOF) that uses LogonUserSSPI API to perform kerberos-based password spray
samdump-bof
Beacon Object File Dump sam file
msspray
Password attacks and MFA validation against various endpoints in Azure and Office 365
amd-ryzen-master-driver-v17-exploit
Cobalt Strike (CS) Beacon Object File (BOF) for kernel exploitation using AMD's Ryzen Master Driver (version 17).
ASRenum-BOF
Cobalt Strike BOF that identifies Attack Surface Reduction (ASR) rules, actions, and exclusion locations
bof-collection
Collection of Beacon Object Files (BOF) for Cobalt Strike
BOF-CredUI
Cobalt Strike Beacon Object File (BOF) that uses CredUIPromptForWindowsCredentials API to invoke credential prompt
LdapSignCheck
Beacon Object File & C# project to check LDAP signing
EXOCET-AV-Evasion
EXOCET - AV-evading, undetectable, payload delivery tool
BOFs-Ransomware-
Collection of personal Beacon Object Files (BOFs)
InlineWhispers2
Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF) via Syswhispers2