LaRancion

LaRancion's Stars

• outflanknl/Dumpert

  LSASS memory dumper using direct system calls and API unhooking.

  Language:C1.5k375241

• chenjj/espoofer

  An email spoofing testing tool that aims to bypass SPF/DKIM/DMARC and forge DKIM signatures.🍻

  Language:Python1.4k2543245

• blacklanternsecurity/TREVORspray

  TREVORspray is a modular password sprayer with threading, clever proxying, loot modules, and more!

  Language:Python1k1728146

• am0nsec/HellsGate

  Original C Implementation of the Hell's Gate VX Technique

  Language:C921197118

• cube0x0/KrbRelay

  Framework for Kerberos relaying

  Language:C#8391613118

• trustedsec/COFFLoader

  Language:C44919371

• zblurx/dploot

  DPAPI looting remotely and locally in Python

  Language:Python40371155

• Octoberfest7/XLL_Phishing

  XLL Phishing Tradecraft

  Language:C3868078

• huntandhackett/process-cloning

  The Definitive Guide To Process Cloning on Windows

  Language:C3854032

• franc-pentest/ldeep

  In-depth ldap enumeration utility

  Language:Python38462043

• ricardojoserf/NativeDump

  Dump lsass using only Native APIs by hand-crafting Minidump files (without MinidumpWriteDump!)

  Language:C#3797253

• EgeBalci/deoptimizer

  Evasion by machine code de-optimization.

  Language:Rust3155120

• lypd0/DeadPotato

  DeadPotato is a windows privilege escalation utility from the Potato family of exploits, leveraging the SeImpersonate right to obtain SYSTEM privileges. This script has been customized from the original GodPotato source code by BeichenDream.

  Language:C#2605133

• CICADA8-Research/IHxExec

  Process injection alternative

  Language:C++2512135

• EvilBytecode/EDR-XDR-AV-Killer

  Reproducing Spyboy technique, which involves terminating all EDR/XDR/AVs processes by abusing the zam64.sys driver

  Language:Go2223241

• hasherezade/thread_namecalling

  Process Injection using Thread Name

  Language:C2134025

• MzHmO/LeakedWallpaper

  Leak of any user's NetNTLM hash. Fixed in KB5040434

  Language:C++2043337

• trustedsec/specula

  Language:Python1713316

• VoldeSec/PatchlessInlineExecute-Assembly

  Porting of BOF InlineExecute-Assembly to load .NET assembly in process but with patchless AMSI and ETW bypass using hardware breakpoint.

  Language:C1403018

• vxCrypt0r/AMSI_VEH

  A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, function hooking or Import Address Table (IAT) modification.

  Language:C++1352017

• WKL-Sec/LayeredSyscall

  Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR hooks in Windows.

  Language:C1283016

• odzhan/injection

  Windows process injection methods

  Language:C11941018

• Yaxxine7/ASRepCatcher

  Make everyone in your VLAN ASRep roastable

  Language:Python101204

• EvilBytecode/Lifetime-Amsi-EtwPatch

  Two in one, patch lifetime powershell console, no more etw and amsi!

  Language:Go761011

• Faran-17/Hellshazzard

  Indirect Syscall implementation to bypass userland NTAPIs hooking.

  Language:C52316

• synctop/tpm-mmio

  Using MMIO (Memory-Mapped I/O) to read TPM 2.0 public Endorsement Key.

  Language:C++35106

• c2pain/RustPatchlessCLRLoader

  .NET assembly loader with patchless AMSI and ETW bypass in Rust

  Language:Rust121

• GeisericII/Winpacket

  Impacket pre-compiled binaries

  9100

• MultSec/Modules

  Collection of various malware techniques aimed at Windows through MinGW

  Language:C82

• Sh4N4C1/Havoc_uac_sspi_bof

  Language:C2