-
ESC1-unPAC Public
Forked from RayRRT/ESC1-unPACA Beacon Object File (BOF) that performs the complete ESC1 attack chain in a single execution: certificate request with arbitrary SAN (+SID), PKINIT authentication, and NT hash extraction via UnPAC…
C UpdatedDec 18, 2025 -
Moonwalk-- Public
Forked from klezVirus/Moonwalk--Moonwalk++: Simple POC Combining StackMoonwalking and Memory Encryption
C++ BSD 3-Clause "New" or "Revised" License UpdatedDec 17, 2025 -
checkhv_um Public
Forked from zer0condition/checkhv_umtests to catch some sloppy hv impls
C++ UpdatedDec 17, 2025 -
sigdream Public
Forked from kozmer/sigdreamsigreturn-oriented programming (SROP) based sleep obfuscation poc for Linux
C UpdatedDec 15, 2025 -
AZexec Public
Forked from Logisek/AZexecThe Azure Execution Tool
PowerShell GNU General Public License v3.0 UpdatedDec 14, 2025 -
Killer Public
Forked from Nekr0w/killerNon HVCI Block listed - Microsoft signed driver exploited to kill AV/EDR's processes
C UpdatedDec 14, 2025 -
nebula Public
Forked from vmsplit/nebulaarm64 linux position-independent shellcode framework
C UpdatedDec 12, 2025 -
VectoredOverloading Public
Forked from CheckPointSW/VectoredOverloadingC++ MIT License UpdatedDec 11, 2025 -
Nodejs-Tracer Public
Forked from CheckPointSW/Nodejs-TracerJavaScript MIT License UpdatedDec 11, 2025 -
BOF_RunPe Public
Forked from NtDallas/BOF_RunPeBOF to run PE in Cobalt Strike Beacon without console creation
C++ UpdatedDec 11, 2025 -
IHxExec Public
Forked from CICADA8-Research/IHxExecProcess injection alternative
-
CVE-2025-53772 Public
Forked from sailay1996/CVE-2025-53772poc for cve-2025-53772
-
SessionHop Public
Forked from 3lp4tr0n/SessionHopWindows Session Hijacking via COM
C# UpdatedDec 10, 2025 -
CLR-Unhook Public
Forked from hwbp/CLR-UnhookModern security products (CrowdStrike, Bitdefender, SentinelOne, etc.) hook the nLoadImage function inside clr.dll to intercept and scan in-memory .NET assembly loads. This tool unhooks that functi…
C++ UpdatedDec 9, 2025 -
seccomp-notify-injection Public
Forked from outflanknl/seccomp-notify-injectionLinux Process Injection via Seccomp Notifier
C Apache License 2.0 UpdatedDec 9, 2025 -
ScreenshotBOF Public
Forked from CodeXTF2/ScreenshotBOFAn alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot saved to disk as a file.
C MIT License UpdatedDec 9, 2025 -
SharpVeeamDecryptor Public
Forked from S3cur3Th1sSh1t/SharpVeeamDecryptorDecrypt Veeam database passwords
C# BSD 3-Clause "New" or "Revised" License UpdatedDec 9, 2025 -
LazyHook Public
Forked from hwbp/LazyHookEvade behavioral analysis by executing malicious code within trusted Microsoft call stacks, patchless hooking library IAT/EAT.
C++ MIT License UpdatedDec 8, 2025 -
emerald_template Public template
Forked from 0xTriboulet/emerald_templateA cmake template for crystal palace
CMake UpdatedDec 8, 2025 -
Find-AdminAccess Public
Forked from lsecqt/Find-AdminAccessThis C# tool sprays for admin access over the entire domain
C# UpdatedDec 7, 2025 -
stillepost Public
Forked from dis0rder0x00/stillepostUsing Chromium-based browsers as a proxy for C2 traffic.
C MIT License UpdatedDec 6, 2025 -
execute-assembly-pico Public
Forked from ofasgard/execute-assembly-picoA PICO for Crystal Palace that implements CLR hosting to execute a .NET assembly in memory.
C GNU General Public License v2.0 UpdatedDec 5, 2025 -
krakenhashes Public
Forked from ZerkerEOD/krakenhashesGo GNU Affero General Public License v3.0 UpdatedDec 4, 2025 -
KernelResearchKit Public
Forked from wesmar/KernelResearchKitWindows 11 kernel research framework demonstrating DSE bypass on Windows 11 25H2 through boot-time execution. Loads unsigned drivers by surgically patching SeCiCallbacks via native subsystem. Inclu…
C++ UpdatedDec 4, 2025 -
AbortCommand Public
Forked from PN-Tester/AbortCommandCobaltStrike aggressor script to add context-menu option for clearing beacon queues
UpdatedDec 4, 2025 -
Crystal-Kit Public
Forked from rasta-mouse/Crystal-KitEvasion for Cobalt Strike
C MIT License UpdatedDec 3, 2025 -
process-notify Public
Forked from InfinityCurveLabs/process-notifyasync beacon object file for notification on process creation
C UpdatedDec 3, 2025 -
KrbNixPwn Public
Forked from onSec-fr/KrbNixPwnA Native Bash Framework for Kerberos Ticket Extraction on Linux 🔐
Shell UpdatedDec 3, 2025 -
CVE-2023-1206-CVE-2025-40040-CVE-2024-49882 Public
Forked from SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-498823 linux kernel bugs chains to do secure comm app using side channel to establish key and establish covert channe;
C UpdatedDec 2, 2025 -
SharpSCOM Public
Forked from breakfix/SharpSCOMA C# utility for interacting with SCOM
C# Other UpdatedDec 2, 2025
{{ message }}