TheWover

Pinned Repositories

SharpSploit
SharpSploit is a .NET post-exploitation library written in C#
Language:C#1.8k 83 23321
CertStealer
A .NET tool for exporting and importing certificates without touching disk.
Language:C#478 14 068
DInvoke
Dynamically invoke arbitrary unmanaged code from managed code without PInvoke.
Language:C#700 15 20108
donut
Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters
Language:C3.7k 79 108651
donut-demos
Demos of Donut used in conferences, etc. Mostly for my use, but free for others to use as a reference.
31 4 03
EasyNet
Simple packer for arbitrary data using only .NET API calls. Produces a unique signature with every usage. Standalone program and library. Algorithm: Data <-> GZip <-> AES-256 <-> Base64.
Language:C#90 10 024
GhostLoader
GhostLoader - AppDomainManager - Injection - 攻壳机动队
Language:C#154 4 082
Manager
Library of tools and examples for loading/bootstrapping managed code from unmanaged code in .NET
Language:C++62 7 111
ModuleMonitor
Uses WMI Event Win32_ModuleLoadTrace to monitor module loading. Provides filters, and detailed data. Has an option to monitor for CLR Injection attacks.
Language:C#39 2 010
TheWover.github.io
Blog. Watch the repo to subscribe
Language:SCSS5 3 06

TheWover's Repositories

TheWover/pe_to_shellcode
Converts PE into a shellcode
Language:Assembly2 2 0
TheWover/clrinject
Injects C# EXE or DLL Assembly into every CLR runtime and AppDomain of another process.
Language:C++1 2 0
TheWover/hollows_hunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Language:C++1
TheWover/nopowershell
PowerShell rebuilt in C# for Red Teaming purposes
Language:C#1 2 0
TheWover/pinvoke-interop-assistant
PInvoke Interop Assistant
Language:C#1 2 01
TheWover/WinXRunPE-x86_x64
💉 Two C# RunPE's capable of x86 and x64 injections 💉
Language:C#1 2 01
TheWover/ADTimeline
PowerShell script creating a timeline with Active Directory replication metadata
Language:PowerShell2 0
TheWover/AggressorCollection
Collection of awesome Cobalt Strike Aggressor Scripts. All credit due to the authors
Language:PowerShell
TheWover/AmsiScanBufferBypass
Language:C#
TheWover/AndrewSpecial
AndrewSpecial, dumping lsass' memory stealthily and bypassing "Cilence" since 2019.
Language:C++2 0
TheWover/ATTACK-Tools
Utilities for MITRE™ ATT&CK
Language:PLpgSQL
TheWover/COMHijacker
Persistent through COM Hijacking
Language:C++
TheWover/consoleframework
Cross-platform toolkit for easy development of TUI applications.
Language:C#
TheWover/csharp
Various C# projects for offensive security
Language:C#2 0
TheWover/DKMC
DKMC - Dont kill my cat - Malicious payload evasion tool
Language:Python2 0
TheWover/dll_to_exe
Converts a DLL into EXE
Language:C++
TheWover/DllExport
.NET DllExport
Language:C#
TheWover/Ebowla
Framework for Making Environmental Keyed Payloads (NO LONGER SUPPORTED)
Language:Python2 0
TheWover/external_c2_framework
Python api for usage with cobalt strike's External C2 specification
Language:Python
TheWover/IAT_patcher
Persistent IAT hooking application - based on bearparser
Language:C++2 0
TheWover/krabsetw
KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.
Language:C++2 0
TheWover/LimeUSB
Malware USB Spread | Example
Language:Visual Basic2 0
TheWover/MemScan
Quick Proof of Concept for reading a processes memory and searching for a specific string.
Language:C#1 0
TheWover/pe-sieve
Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
Language:C++2 0
TheWover/pocs
Proof of Concepts (PE, PDF...)
Language:Assembly2 0
TheWover/shed
.NET runtime inspector
Language:C#2 0
TheWover/Superior-Injector
C# LoadLibrary and ManualMap injector
Language:C#
TheWover/Testura.Code
Testura.Code is a wrapper around the Roslyn API and used for generation, saving and compiling C# code. It provides methods and helpers to generate classes, methods, statements and expressions.
Language:C#
TheWover/VBA-RunPE
A VBA implementation of the RunPE technique or how to bypass application whitelisting.
Language:Visual Basic2 0
TheWover/WinObjEx64
Windows Object Explorer 64-bit
Language:C2 0