Pinned Repositories
Galvatron
Powershell fork of Monohard by Carlos Ganoza P. This botnet/backdoor was designed to egress over unecrypted web using very little, but effective obfuscation. Egress over ICMP and DNS are planned as features. Lastly, the server code is designed to setup the C2 on a LAMP-esque server. The default creds are admin/admin.
MacroShop
Collection of scripts to aid in delivering payloads via Office Macros. Most are python. See http://khr0x40sh.wordpress.com for details.
malwareanalysis
snippets related to malware analysis
metasploit-modules
ms16-032
ms16_032_DLL
DLL of MS16-032 Exploit
PowerSurfer
A powershell based traffic generation scripts to simulate user activity via Internet Explorer
PowerW0rm
WhiteListEvasion
Collection of scripts, binaries and the like to aid in WhiteList Evasion on a Microsoft Windows Network.
khr0x40sh's Repositories
khr0x40sh/Mockingjay
Tests and implementation of Mockingjay technique
khr0x40sh/LNKfun
A simple LNK file parser/editor written in PS1.
khr0x40sh/CVE-2024-4956
CVE-2024-4956 Python exploitation utility
khr0x40sh/SharpMockingJay
C# / .NET implementation of the local DLL Injection use case of the MockingJay EDR Bypass technique
khr0x40sh/AmsiBypassHookManagedAPI
A new AMSI Bypass technique using .NET ALI Call Hooking.
khr0x40sh/AndroRAT
A Simple android remote administration tool using sockets. It uses java on the client side and python on the server side
khr0x40sh/AsmHalosGate
x64 Assembly HalosGate direct System Caller to evade EDR UserLand hooks
khr0x40sh/ASPJinjaObfuscator
Heavily obfuscated ASP web shell generation tool.
khr0x40sh/CVE-2023-20178
khr0x40sh/defcon27_csharp_workshop
Writing custom backdoor payloads with C# - Defcon 27 Workshop
khr0x40sh/Divert
WinDivert: Windows Packet Divert
khr0x40sh/EDRSandblast
khr0x40sh/GodPotato
khr0x40sh/grading-1
khr0x40sh/grading-2
khr0x40sh/InvisibilityCloak
Proof-of-concept obfuscation toolkit for C# post-exploitation tools
khr0x40sh/PoshC2_Core
khr0x40sh/pyJWT-testing
JWT testing with Python / Flask
khr0x40sh/RemoteShellcodeExec
Execute shellcode from a remote-hosted bin file using Winhttp.
khr0x40sh/RWXfinder
The program uses the Windows API functions to traverse through directories and locate DLL files with RWX section
khr0x40sh/SharpHalos
My implementation of Halo's Gate technique in C#
khr0x40sh/SilkETW
khr0x40sh/syscalls-rs
Rusty Syscalls - A direct or indirect Syscall library in Rust using the FreshyCalls/SysWhispers technique
khr0x40sh/SyscallsExample
Simple project using syscalls (via Syswhispers2) to execute MessageBox shellcode.
khr0x40sh/TartarusGate
TartarusGate, Bypassing EDRs
khr0x40sh/ThreadlessInject
Threadless Process Injection using remote function hooking.
khr0x40sh/ThreadlessInject-BOF
BOF implementation of @_EthicalChaos_'s ThreadlessInject project. A novel process injection technique with no thread creation, released at BSides Cymru 2023.
khr0x40sh/VirusTotalC2
Abusing VirusTotal API to host our C2 traffic, usefull for bypassing blocking firewall rules if VirusTotal is in the target white list , and in case you don't have C2 infrastructure , now you have a free one
khr0x40sh/warlusts
If you found this, you are among the truly lucky, to be given providence to my curated and often custom wordlists. Enjoy, buddy, you've earned it.
khr0x40sh/wmiexec-Pro
New generation of wmiexec.py