使用分支对抗技术制作的PHP Webshell，截止2024年1月18日，共数十个查杀引擎免杀

修改https://github.com/LC044/WeChatMsg 实现离线解密展示聊天记录

reflectively load and execute PEs locally and remotely bypassing EDR hooks

Remove AV/EDR Kernel ObRegisterCallbacks、CmRegisterCallback、MiniFilter Callback、PsSetCreateProcessNotifyRoutine Callback、PsSetCreateThreadNotifyRoutine Callback、PsSetLoadImageNotifyRoutine Callback...

A small x64 library to load dll's into memory.

Documents Exfiltration project for fun and educational purposes

Proof-of-Concept for CVE-2023-38146 ("ThemeBleed")

Protected Process Dumper Tool

SharpLDAP is a tool written in C# that aims to do enumeration via LDAP queries

Amsi Bypass payload that works on Windwos 11

Remote Shellcode Injector

cmd2shellcode

A POC of a new “threadless” process injection technique that works by utilizing the concept of DLL Notification Callbacks in local and remote processes.

A POC of the ContainYourself research presented in DEF CON 31, which abuses the Windows containers framework to bypass EDRs.

Webshell Manager

Escalate Service Account To LocalSystem via Kerberos

XSS payloads for bypassing WAF. This repository is updating continuously.

GetProcAddressByHash/remap/full dll unhooking/Tartaru's Gate/Spoofing Gate/universal/Perun's Fart/Spoofing-Gate/EGG/RecycledGate/syswhisper/RefleXXion golang implementation

dump lsass

Duplicate not owned Token from Running Process

在Windows环境下的进程注入方法：远程线程注入、创建进程挂起注入、反射注入、APCInject、SetWindowHookEX注入

Set of python scripts which perform different ways of command execution via WMI protocol.

Windows x64 kernel mode rootkit process hollowing POC.