LaRancion's Stars
outflanknl/Dumpert
LSASS memory dumper using direct system calls and API unhooking.
chenjj/espoofer
An email spoofing testing tool that aims to bypass SPF/DKIM/DMARC and forge DKIM signatures.🍻
blacklanternsecurity/TREVORspray
TREVORspray is a modular password sprayer with threading, clever proxying, loot modules, and more!
am0nsec/HellsGate
Original C Implementation of the Hell's Gate VX Technique
cube0x0/KrbRelay
Framework for Kerberos relaying
trustedsec/COFFLoader
zblurx/dploot
DPAPI looting remotely and locally in Python
Octoberfest7/XLL_Phishing
XLL Phishing Tradecraft
huntandhackett/process-cloning
The Definitive Guide To Process Cloning on Windows
franc-pentest/ldeep
In-depth ldap enumeration utility
ricardojoserf/NativeDump
Dump lsass using only Native APIs by hand-crafting Minidump files (without MinidumpWriteDump!)
EgeBalci/deoptimizer
Evasion by machine code de-optimization.
lypd0/DeadPotato
DeadPotato is a windows privilege escalation utility from the Potato family of exploits, leveraging the SeImpersonate right to obtain SYSTEM privileges. This script has been customized from the original GodPotato source code by BeichenDream.
CICADA8-Research/IHxExec
Process injection alternative
EvilBytecode/EDR-XDR-AV-Killer
Reproducing Spyboy technique, which involves terminating all EDR/XDR/AVs processes by abusing the zam64.sys driver
hasherezade/thread_namecalling
Process Injection using Thread Name
MzHmO/LeakedWallpaper
Leak of any user's NetNTLM hash. Fixed in KB5040434
trustedsec/specula
VoldeSec/PatchlessInlineExecute-Assembly
Porting of BOF InlineExecute-Assembly to load .NET assembly in process but with patchless AMSI and ETW bypass using hardware breakpoint.
vxCrypt0r/AMSI_VEH
A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, function hooking or Import Address Table (IAT) modification.
WKL-Sec/LayeredSyscall
Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR hooks in Windows.
odzhan/injection
Windows process injection methods
Yaxxine7/ASRepCatcher
Make everyone in your VLAN ASRep roastable
EvilBytecode/Lifetime-Amsi-EtwPatch
Two in one, patch lifetime powershell console, no more etw and amsi!
Faran-17/Hellshazzard
Indirect Syscall implementation to bypass userland NTAPIs hooking.
synctop/tpm-mmio
Using MMIO (Memory-Mapped I/O) to read TPM 2.0 public Endorsement Key.
c2pain/RustPatchlessCLRLoader
.NET assembly loader with patchless AMSI and ETW bypass in Rust
GeisericII/Winpacket
Impacket pre-compiled binaries
MultSec/Modules
Collection of various malware techniques aimed at Windows through MinGW
Sh4N4C1/Havoc_uac_sspi_bof