Payload Obfuscation for Red Teams workshop materials

Cobalt Strike UDRL for memory scanner evasion.

CVE-2023-38408 Remote Code Execution in OpenSSH's forwarded ssh-agent

BSides Prishtina 2024 Malware Development and Persistence workshop

A newer iteration of TitanLdr with some newer hooks, and design. A generic user defined reflective DLL I built to prove a point to Mudge years ago.

Course materials for Modern Binary Exploitation by RPISEC

Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird + Spawns a sacrificial Process as target process + (ACG+Bloc…

BOFs for BRC4

An easily modifiable shellcode template for Windows x64 written in C

该项目为Shellocde加载器，详细介绍了我们如何绕过防病毒软件，以及该工具如何使用

Hiding shellcode in plain sight within a large memory region. Inspired by technique used by Raspberry Robin's Roshtyak

UAC Bypass using RequestTrace scheduled task

eBPF implementation that runs on top of Windows

免杀主流防病毒软件

UEFI Bootkit with user-mode communication

Seven different DLL injection techniques in one single project.

Windows LPE Exploit

Fully decrypt App-Bound Encrypted (ABE) cookies, passwords & payment methods from Chromium-based browsers (Chrome, Brave, Edge) - all in user mode, no admin rights required.

Tool for playing with Windows Access Token manipulation.

Windows 10 Rootkit, that hooks GDI functions

Utilizing CLang For Offensive Operations.

The Definitive Guide To Process Cloning on Windows

Evasive loader to bypass static detection

Example of using Windows Platform Binary Table (WPBT)

Injecting DLL into LSASS at boot

Time-Based Detection and Response for Safety-Critical Real-Time Embedded Systems - EDR Kernel Extension for FreeRTOS