Pinned Repositories
AceLdr
Cobalt Strike UDRL for memory scanner evasion.
Alaris
A protective and Low Level Shellcode Loader the defeats modern EDR systems.
BeaconHunter
Detect and respond to Cobalt Strike beacons using ETW.
BlockEtw
.Net Assembly to block ETW telemetry in current process
CVE-2023-27470_Exercise
GodPotato
Screenshottery
Simple spyware that takes screenshots on target computer every "x" amount of seconds.
WMImplant
This is a PowerShell based tool that is designed to act like a RAT. Its interface is that of a shell where any command that is supported is translated into a WMI-equivalent for use on a network/remote machine. WMImplant is WMI based.
ccmpwn
msi-search
3lp4tr0n's Repositories
3lp4tr0n/BeaconHunter
Detect and respond to Cobalt Strike beacons using ETW.
3lp4tr0n/CVE-2023-27470_Exercise
3lp4tr0n/GodPotato
3lp4tr0n/AceLdr
Cobalt Strike UDRL for memory scanner evasion.
3lp4tr0n/CheeseOunce
Coerce Windows machines auth via MS-EVEN
3lp4tr0n/CVE-2021-40444
CVE-2021-40444 PoC
3lp4tr0n/DInvoke
Dynamically invoke arbitrary unmanaged code from managed code without PInvoke.
3lp4tr0n/DynamicWrapperDotNet
Dynamically Loads Assembly and Calls Methods from JScript
3lp4tr0n/expbox
Vulnerability Exploitation Code Collection Repository
3lp4tr0n/Ghostpack-CompiledBinaries
Compiled Binaries for Ghostpack (.NET v4.0)
3lp4tr0n/InlineExecute-Assembly
InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module
3lp4tr0n/merlin
Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.
3lp4tr0n/Mimikore
.NET 5 Single file Application
3lp4tr0n/msi-search
3lp4tr0n/Ninja_UUID_Runner
Module Stomping, No New Thread, HellsGate syscaller, UUID Shellcode Runner for x64 Windows 10!
3lp4tr0n/OffensiveVBA
This repo covers some code execution and AV Evasion methods for Macros in Office documents
3lp4tr0n/OfficePurge
3lp4tr0n/Pluto
A manual system call library that supports functions from both ntdll.dll and win32u.dll
3lp4tr0n/PPLDump_BOF
A faithful transposition of the key features/functionality of @itm4n's PPLDump project as a BOF.
3lp4tr0n/PrintNightmare
3lp4tr0n/ProcessHollowing
3lp4tr0n/route-sixty-sink
Link sources to sinks in C# applications.
3lp4tr0n/S4UTomato
Escalate Service Account To LocalSystem via Kerberos
3lp4tr0n/SharpCollection
Nightly builds of common C# offensive tools, fresh from their respective master branches built and released in a CDI fashion using Azure DevOps release pipelines.
3lp4tr0n/SharpNamedPipePTH
Pass the Hash to a named pipe for token Impersonation
3lp4tr0n/SyscallAmsiScanBufferBypass
AmsiScanBufferBypass using D/Invoke
3lp4tr0n/titan
Titan: A generic user defined reflective DLL for Cobalt Strike
3lp4tr0n/TitanLdr
Titan: A crappy Reflective Loader written in C and assembly for Cobalt Strike. Redirects DNS Beacon over DoH
3lp4tr0n/WAMBam
Tooling related to the WAM Bam - Recovering Web Tokens From Office blog post
3lp4tr0n/WFH