FirstBlue

FirstBlue's Stars

• hfiref0x/UACME

  Defeating Windows User Account Control

  Language:C6.2k2771171.3k

• TheCruZ/kdmapper

  KDMapper is a simple tool that exploits iqvw64e.sys Intel driver to manually map non-signed drivers in memory

  Language:C++1.9k34106493

• p3nt4/PowerShdll

  Run PowerShell with rundll32. Bypass software restrictions.

  Language:C#1.7k5914250

• Idov31/Nidhogg

  Nidhogg is an all-in-one simple to use rootkit.

  Language:C++1.7k3215258

• vitoplantamura/BugChecker

  SoftICE-like kernel debugger for Windows 11

  Language:C922398128

• hackerhouse-opensource/iscsicpl_bypassUAC

  UAC bypass for x64 Windows 7 - 11

  Language:C++785162147

• klezVirus/SilentMoonwalk

  PoC Implementation of a fully dynamic call stack spoofer

  Language:C++66511193

• frkngksl/Shoggoth

  Shoggoth: Asmjit Based Polymorphic Encryptor

  Language:C++65012683

• Dec0ne/HWSyscalls

  HWSyscalls is a new method to execute indirect syscalls using HWBP, HalosGate and a synthetic trampoline on kernel32 with HWBP.

  Language:C++5965294

• wbenny/DetoursNT

  Detours with just single dependency - NTDLL

  Language:C++595263122

• zodiacon/windowskernelprogrammingbook

  The Windows Kernel Programming book samples

  Language:C++588186118

• wbenny/KSOCKET

  KSOCKET provides a very basic example how to make a network connections in the Windows Driver by using WSK

  Language:C463159128

• deepinstinct/Lsass-Shtinkering

  Language:C++3725141

• itm4n/PPLcontrol

  Controlling Windows PP(L)s

  Language:C++2524540

• wolfSSL/wolfssl-examples

  Example applications using the wolfSSL lightweight SSL/TLS library

  Language:C2483650175

• gmh5225/CallMeWin32kDriver

  Load your driver like win32k.sys

  Language:C++2467075

• LloydLabs/ntqueueapcthreadex-ntdll-gadget-injection

  This novel way of using NtQueueApcThreadEx by abusing the ApcRoutine and SystemArgument[0-3] parameters by passing a random pop r32; ret gadget can be used for stealthy code injection.

  Language:C2294233

• MiroKaku/libwsk

  The Kernel-Mode Winsock library, supporting TCP, UDP and Unix sockets (DGRAM and STREAM).

  Language:C++22611577

• rad9800/hwbp4mw

  Language:C++2063042

• hjc4869/UacBypass

  A demo to bypass windows 10 default UAC configuration using IFileOperation and dll hijacking

  Language:C++19119158

• nospaceships/raw-socket-sniffer

  Packet capture on Windows without a kernel driver

  Language:C1808746

• BarbaTunnelCoder/BarbaTunnel

  A layer that hide, redirect. forward, re-encrypt internet packet to keep VPN, Proxies and other p2p software hidden from Firewall. Free implementation for HTTP-Tunnel, UDP-Tunnel, port forwarding, port redirecting and packet re-encryption that can work in network data-link layer and transport layer

  Language:C++17920758

• SaadAhla/ntdlll-unhooking-collection

  different ntdll unhooking techniques : unhooking ntdll from disk, from KnownDlls, from suspended process, from remote server (fileless)

  Language:C++1714137

• paranoidninja/Proxy-DLL-Loads

  The code is a pingback to the Dark Vortex blog:

  Language:C1607028

• kiyolee/zlib-win-build

  zlib Windows build with Visual Studio.

  Language:C15810646

• paranoidninja/Proxy-Function-Calls-For-ETwTI

  The code is a pingback to the Dark Vortex blog: https://0xdarkvortex.dev/hiding-memory-allocations-from-mdatp-etwti-stack-tracing/

  Language:C1576031

• kiyolee/openssl1_1-win-build

  openssl-1.1 Windows build with Visual Studio.

  Language:C7571524

• Dark7oveRR/kdmapper

  KDMAPPER build [1809,1903,1909,2004]

  Language:C++691320

• ASkyeye/CVE-2018-19320

  Exploiting ring0 memcpy-like functionality to disable Driver Signing Enforcement (DSE)

  Language:C++182026

• wumb0/zerosum0x0_SassyKitdi

  Clone of zerosum0x0's Windows Kernel rootkit written in Rust

  Language:Rust5102