Modular C# framework to exfiltrate loot over secure and trusted channels.

Egress-Assess is a tool used to test egress data detection capabilities

Data exfiltration over DNS request covert channel

Cobalt Strike kit for Lateral Movement

Fileless lateral movement tool that relies on ChangeServiceConfigA to run command

Persistence by writing/reading shellcode from Event Log

.NET project for installing Persistence

SharPyShell - tiny and obfuscated ASP.NET webshell for C# web applications

Cobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks by spawning sacrificial process with Arbitrary Code Guard (AC…

Loads any C# binary in mem, patching AMSI + ETW.

Beacon Object File PoC implementation of KillDefender

Identifies the bytes that Microsoft Defender flags on.

Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods

A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA based scripts.

Villain is a high level stage 0/1 C2 framework that can handle multiple reverse TCP & HoaxShell-based shells, enhance their functionality with additional features (commands, utilities) and share th…

Automating Juicy Potato Local Privilege Escalation CMD exploit for penetration testers.

Enumerate missing KBs and suggest exploits for useful Privilege Escalation vulnerabilities

PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)

SharpUp is a C# port of various PowerUp functionality.

Mimikatz implementation in pure Python

.NET implementation of Get-GPPPassword. Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.

Retrieve LAPS password from LDAP

A little tool to play with Windows security

A collaborative, multi-platform, red teaming framework

The Havoc Framework

AzureC2Relay is an Azure Function that validates and relays Cobalt Strike beacon traffic by verifying the incoming requests based on a Cobalt Strike Malleable C2 profile.

An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR

Adversary Emulation Framework