kara-4search Goto Github PK

redguard

RedGuard is a C2 front flow control tool,Can avoid Blue Teams,AVs,EDRs check.

redteamcsharpscripts

C# Script used for Red Team

reflectivedllinjection

Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process.

reverse-engineering

A FREE comprehensive reverse engineering tutorial covering x86, x64, 32-bit ARM & 64-bit ARM architectures.

scarecrow

ScareCrow - Payload creation framework designed around EDR bypass.

sharpblock

A method of bypassing EDR's active projection DLL's by preventing entry point exection

sharpchromium

.NET 4.0 CLR Project to retrieve Chromium data, such as cookies, history and saved logins.

sharphandler

sharpstay

.NET project for installing Persistence

sharpunhooker

C# Based Universal API Unhooker

sharpxdecrypt

Xshell全版本密码恢复工具

shellcodefluctuation

An advanced in-memory evasion technique fluctuating shellcode's memory protection between RW/NoAccess & RX and then encrypting/decrypting its contents

shellcodeloader

将shellcode用rsa加密并动态编译exe，自带几种反沙箱技术。

simple_shellcodeloader_csharp

A Simple ShellcodeLoader

some_pentesters_securityresearchers_redteamers

Some Pentesters, Security Researchers, Red Teamers which i learned from them a lot...

sourcepoint

SourcePoint is a C2 profile generator for Cobalt Strike command and control servers designed to ensure evasion.

spectre

A Windows kernel-mode rootkit that abuses legitimate communication channels to control a machine.

spoolfool

Exploit for CVE-2022-21999 - Windows Print Spooler Elevation of Privilege Vulnerability (LPE)

sweetpotato

Local Service to SYSTEM privilege escalation from Windows 7 to Windows 10 / Server 2019

sweetpotato-1

Modifying SweetPotato to support load shellcode and webshell

syscall_shellcodeload_csharp

Load shellcode via syscall

tangledwinexec

PoCs and tools for investigation of Windows process execution techniques

taskschedule-persistence-download-cradles

Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged

tdl

Driver loader for bypassing Windows x64 Driver Signature Enforcement

tenet

A Trace Explorer for Reverse Engineers

test

test

threadhijacking_csharp

Process inject technique "Thread hijacking" via csharp

titan

Golang C2 and Beacon/Agent built from the ground up for scalability and expandability

uac-bypass-using-dll-injection

A small project to bypass UAC in windows 10/8/7 using dll injection technique

vba-runpe

A VBA implementation of the RunPE technique or how to bypass application whitelisting.