Fast C++ logging library.

A simple C++11 Thread Pool implementation

2021年最新整理， C++ 学习资料，含C++ 11 / 14 / 17 / 20 / 23 新特性、入门教程、推荐书籍、优质文章、学习笔记、教学视频等

An even funnier way to disable windows defender. (through WSC api)

Converts PE into a shellcode

EDR Lab for Experimentation Purposes

Remove AV/EDR Kernel ObRegisterCallbacks、CmRegisterCallback、MiniFilter Callback、PsSetCreateProcessNotifyRoutine Callback、PsSetCreateThreadNotifyRoutine Callback、PsSetLoadImageNotifyRoutine Callback...

Now You See Me, Now You Don't

Another Windows Local Privilege Escalation from Service Account to System

Shoggoth: Asmjit Based Polymorphic Encryptor

This repo contains C/C++ snippets that can be handy in specific offensive scenarios.

Lifetime AMSI bypass

Load/Inject .NET assemblies by; reusing the host (spawnto) process loaded CLR AppDomainManager, Stomping Loader/.NET assembly PE DOS headers, Unlinking .NET related modules, bypassing ETW+AMSI, avo…

Shadow Dumper is a powerful tool used to dump LSASS memory, often needed in penetration testing and red teaming. It uses multiple advanced techniques to dump memory, allowing to access sensitive da…

This is the tool to dump the LSASS process on modern Windows 11

dump lsass进程工具

A native backdoor module for Microsoft IIS (Internet Information Services)

Windows Defender Killer | C++ Code Disabling Permanently Windows Defender using Registry Keys

CPP AV/EDR Killer

Bypassing UAC with SSPI Datagram Contexts

从内存中提取浏览器和Todesk用户凭证

Windows对抗沙箱和虚拟机的方法总结

DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely

AntiAV shellcode loader

Netview enumerates systems using WinAPI calls

汇总了目前可以找到的所有的进程注入的方式，完成了x86/x64下的测试，不断更新中

Leak of any user's NetNTLM hash. Fixed in KB5040434

A collection of proof-of-concept source code and scripts for executing remote commands over WinRM using the WSMan.Automation COM object