0x00Check
Security Engineer interested in offensive security and malware.👾Self-taught programmer; open to constructive criticism and eager to expand my knowledge!
Pinned Repositories
0x00Check.github.io
Amaterasu
Amaterasu terminates, or inhibits, protected processes such as application control and AV/EDR solutions by leveraging the Sysinternals Process Explorer driver to kill a process's handles from kernel mode.
ExploitLeakedHandle
Identify and exploit leaked handles for local privilege escalation.
Find-UserlandHooks
PowerShell script to find NTDLL functions that may be hooked by AV or EDR by comparing what exists on disk with the loaded ntdll module.
Get-SyscallID
PowerShell script to retrieve the system call numbers for Nt/Zw functions exported in NTDLL.
MS13-098
PowerShell script to append data to executables without invalidating their digital signature. (MS13-098)
Process_Injection_Framework
PIF is a tool that facilitates injecting & executing arbitrary code in remote processes through various process injection techniques.
PsSetCreateProcessNotifyRoutineEx
Minimal driver that calls PsSetCreateProcessNotifyRoutineEx and writes basic process information to the kernel debugger. For educational purposes.
0x00Check's Repositories
0x00Check/ExploitLeakedHandle
Identify and exploit leaked handles for local privilege escalation.
0x00Check/Amaterasu
Amaterasu terminates, or inhibits, protected processes such as application control and AV/EDR solutions by leveraging the Sysinternals Process Explorer driver to kill a process's handles from kernel mode.
0x00Check/Find-UserlandHooks
PowerShell script to find NTDLL functions that may be hooked by AV or EDR by comparing what exists on disk with the loaded ntdll module.
0x00Check/MS13-098
PowerShell script to append data to executables without invalidating their digital signature. (MS13-098)
0x00Check/PsSetCreateProcessNotifyRoutineEx
Minimal driver that calls PsSetCreateProcessNotifyRoutineEx and writes basic process information to the kernel debugger. For educational purposes.
0x00Check/Get-SyscallID
PowerShell script to retrieve the system call numbers for Nt/Zw functions exported in NTDLL.
0x00Check/Process_Injection_Framework
PIF is a tool that facilitates injecting & executing arbitrary code in remote processes through various process injection techniques.
0x00Check/0x00Check.github.io