Payload Development

h4wkst3r/invisibilitycloak

Proof-of-concept obfuscation toolkit for C# post-exploitation tools

fortra/no-consolation

A BOF that runs unmanaged PEs inline

vulncheck-oss/go-exploit

Go-based exploit development framework with built-in phases for target verification, version scanning, exploitation, and C2. Supports multiple…

secrary/injectproc

InjectProc - Process Injection Techniques [This project is not maintained anymore]

dec0ne/hwsyscalls

HWSyscalls is a new method to execute indirect syscalls using HWBP, HalosGate and a synthetic trampoline on kernel32 with HWBP.

ynwarcs/cve-2024-38063

poc for CVE-2024-38063 (RCE in tcpip.sys)

med0x2e/gadgettojscript

A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA…

virtualalllocex/defcon-31-syscalls-workshop

Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

joasasantos/syswhispers4

AV/EDR evasion via direct and indirect system calls Windows NT 3.1 through Windows 11 24H2 · x64 · x86 · WoW64 · ARM64

med0x2e/executeassembly

Load/Inject .NET assemblies by; reusing the host (spawnto) process loaded CLR AppDomainManager, Stomping Loader/.NET assembly PE DOS headers,…

kyleavery/aceldr

Cobalt Strike UDRL for memory scanner evasion.

hackplayers/salsa-tools

Salsa Tools - ShellReverse TCP/UDP/ICMP/DNS/SSL/BINDTCP/Shellcode/SILENTTRINITY and AV bypass, AMSI patched

lsecqt/offensivecpp

This repo contains C/C++ snippets that can be handy in specific offensive scenarios.

lesnuages/hershell

Multiplatform reverse shell generator

nccgroup/nccfsas

Information released publicly by NCC Group's Full Spectrum Attack Simulation (FSAS) team.

codextf2/screenshotbof

An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot downloaded in memory.

byt3bl33d3r/offensivedlr

Toolbox containing research notes & PoC code for weaponizing .NET's DLR