forrest-orr

moneta

Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs

phantom-dll-hollower-poc

Phantom DLL hollowing PoC

artifacts-kit

Pseudo-malicious usermode memory artifact generator kit designed to easily mimic the footprints left by real malware on an infected Windows OS.

DoubleStar

A personalized/enhanced re-creation of the Darkhotel "Double Star" APT exploit chain with a focus on Windows 8.1 and mixed with some of my own techniques

Exploits

A personal collection of Windows CVE I have turned in to exploit source, as well as a collection of payloads I've written to be used in conjunction with these exploits.

WizardOpium

Google Chrome Use After Free

ExploitDev

Various tools, PoCs and experiments related to my blog at https://www.forrest-orr.net/

Gallery

FileHostTests

RPCDump