msf-ntdll Goto Github PK

stopdefender

Stop Windows Defender programmatically

study_injection_and_hook

注入与hook

sunflower_get_password

一款针对向日葵的识别码和验证码提取工具

suspended-thread-injection

Another meterpreter injection technique using C# that attempts to bypass Defender

suspendedunhook

sweetpotato

SweetPotato修改版，用于webshell下执行命令 感谢@zcgonvh和@RcoIl两位师傅的耐心指导

sweetpotato-1

Local Service to SYSTEM privilege escalation from Windows 7 to Windows 10 / Server 2019

syscallnumberextractor

syscallnumberfinder

syscallpoc

Shellcode injection POC using syscalls.

syscallsexample

Simple project using syscalls (via Syswhispers2) to execute MessageBox shellcode.

syscallslib

a library that automates some clean syscalls to make it easier to implement

sysmoneop

sysmonsimulator

Sysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detections and correlation rules by Blue teams.

systemnightmare

Gives you instant SYSTEM command prompt on all supported and legacy versions of Windows

syswhispers2

AV/EDR evasion via direct system calls.

syswhispers2_x86

X86 version of syswhispers2 / x86 direct system call

syswhispers3

SysWhispers on Steroids - AV/EDR evasion via direct system calls.

tamperingsyscalls

tangledwinexec

C# PoCs for investigation of Windows process execution techniques investigation

taowu-cobalt-strike

targetedkerberoast

Kerberoast with ACL abuse capabilities

tartarusgate

TartarusGate, Bypassing EDRs

taskschedulermisc

Misc TaskScheduler Plays

technet-gallery

Copies of my 'Script Center' and 'Technet Gallery' publications

terraldr

A Payload Loader Designed With Advanced Evasion Features

test

just test

tgtdelegation

tgtdelegation is a Beacon Object File (BOF) to obtain a usable TGT via the "TGT delegation trick"

thematrix

a PE Loader and Windows API tracer. Useful in malware analysis.

threadstackspoofer

Thread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation from scanners and analysts.