Pinned Repositories
BeaconNotifier-Discord
Cobalt strike CNA script to notify you via Discord whenever there is a new beacon.
BOF-patchit
An all-in-one Cobalt Strike BOF to patch, check and revert AMSI and ETW for x64 process. Both syscalls and dynamic resolve versions are available.
CobaltStrikeReflectiveLoader
Cobalt Strike User-Defined Reflective Loader written in Assembly & C for advanced evasion capabilities.
PerunsFart-PPID
Userland API hooking bypass using PerunsFart spawning created process with spoofed PPID
sleepmask_ekko_cfg
Code snippets to add on top of cobalt strike sleepmask kit so that ekko can work in a CFG protected process
sleepmask_PatchlessHook
Code snippets to add on top of cobalt strike sleep mask to achieve patchless hook on AMSI and ETW
SuperSharpShooter
Payload Generation Framework
sw2-secinject
Section Mapping Process Injection modified with SysWhisper2 (sw2-secinject): Cobalt Strike BOF
SysmonQuiet
RDLL for Cobalt Strike beacon to silence sysmon process
vba_bin_runner
Basic python tools to generate shellcode runner in vba
ScriptIdiot's Repositories
ScriptIdiot/getlapsbof
Beacon Object File (BOF) to retrieve and decrypt the the LAPSv2 password from the Windows Active Directory and Microsoft Azure/Entra Active Directory.
ScriptIdiot/ldap_bofs
Random BOFs for LDAP tradecraft
ScriptIdiot/RAITrigger
Local SYSTEM auth trigger for relaying
ScriptIdiot/AIpayloads
Payloads for AI Red Teaming and beyond
ScriptIdiot/BloodHoundQueryLibrary
A community-driven collection of BloodHound queries
ScriptIdiot/BrotherVulnerabilities
Multiple Brother Devices: Multiple Vulnerabilities (CVE-2024-51977, CVE-2024-51978, CVE-2024-51979, CVE-2024-51980, CVE-2024-51981, CVE-2024-51982, CVE-2024-51983, CVE-2024-51984)
ScriptIdiot/ChromeAlone
A tool to transform Chromium browsers into a C2 Implant
ScriptIdiot/cIdentifyServiceDependencies_BOF
Beacon Object File (BOF) for identifying dependent child services of a given parent.
ScriptIdiot/CobaltStrikeBeaconCppSource
Out-of-the-box CobaltStrike Beacon source code use C++
ScriptIdiot/Crappy-ransomware-BOF
Collection of personal Beacon Object Files (BOFs)
ScriptIdiot/Crystal-Loaders
A small collection of Crystal Palace PIC loaders designed for use with Cobalt Strike
ScriptIdiot/DotnetNoVirtualProtectShellcodeLoader
load shellcode without P/D Invoke and VirtualProtect call.
ScriptIdiot/ECUtilities
Powershell and python utilties for Entra Connect
ScriptIdiot/EntraPassTheCert
tool for requesting Entra ID's P2P certificate and authenticating remote Entra joinned devices with it
ScriptIdiot/GetAccessTokenWithSSOCookie
ScriptIdiot/hypnus
Memory Obfuscation in Rust
ScriptIdiot/jules-awesome-list
ScriptIdiot/LoaderGate
a C# implementation for a shellcode loader that capable to bypass Cortex XDR and Sophos EDR.
ScriptIdiot/MLOKit
MLOps Attack Toolkit
ScriptIdiot/newtowner
Abuse trust-boundaries to bypass firewalls and network controls
ScriptIdiot/OktaGinx
ScriptIdiot/pipeleak
Pipeleak is a tool designed to scan CI/CD logs and artifacts for secrets
ScriptIdiot/RAIWhateverTrigger
Local SYSTEM auth trigger for relaying - X
ScriptIdiot/saas_enum
ScriptIdiot/SharpSilentChrome
ScriptIdiot/SignatureKid
ScriptIdiot/Silent_Chrome
This code shows how to silently install Web Store extensions on Google Chrome on MacOS
ScriptIdiot/Trustify
Proof-of-Concept software for creating inbound AD forest trusts.
ScriptIdiot/VEH2
A Patchless AMSI Bypass Technique using VEH²
ScriptIdiot/wambam-bof