BadAssMacros
inf0secrabbit/badassmacrosC# tool that generates malicious VBA macros with shellcode injection, VBA purging, and sandbox detection for red team operations.
exploit-frameworkspayload-generationred-teaming+1
444
inf0secrabbit/badassmacrosC# tool that generates malicious VBA macros with shellcode injection, VBA purging, and sandbox detection for red team operations.
boyan-milanov/ropiumAutomated ROP chain builder that extracts and analyzes gadgets from binaries using semantic queries, supporting X86/X64 architectures with a Python…
senzee1984/micr0_shellmicr0shell is a Python script that dynamically generates Windows X64 PIC Null-Free reverse shell shellcode.
f1zm0/hadesGo shellcode loader that combines multiple evasion techniques
ntdallas/bof_executeassemblyBeacon Object File for Cobalt Strike that executes .NET assemblies in beacon with evasion techniques.
acedef/synthaptPlaybook-based adversary simulation framework that compiles JSON-defined attack paths into position-independent shellcode payloads for validating…
aahmad097/badoutlookProof-of-concept C# tool that reads Outlook emails via COM interface, extracts base64-encoded shellcode from trigger subject lines, and executes…
ofasgard/execute-assembly-picoA PICO for Crystal Palace that implements CLR hosting to execute a .NET assembly in memory.
zznop/sploitGo package that aids in binary analysis and exploitation
bohops/dynamicdotnetA collection of various and sundry code snippets that leverage .NET dynamic tradecraft
d3ext/dfshellPython-based forward shell tool that creates a TTY-like interactive shell over HTTP using named pipes, enabling command execution on firewalled…
0xsch1zo/nullgateLibrary that eases the use of indirect syscalls. Quite interesting AV/EDR bypass as PoC.
cobalt-strike/edenA PoC UDRL for Cobalt Strike built with Crystal Palace that combines Raphael Mudge's page streaming technique with a modular call gate (Draugr)
nirvanaon/nowNØW is a word-based shellcode encoding and obfuscation tool that transforms raw shellcode bytes into natural-looking English prose.
iss4cf0ng/ironpeRust-based Windows PE manual loader that maps and executes x86/x64 executables from memory, demonstrating internal loader behavior and PE structure…
kuwaitist/astral_projectionCobalt Strike UDRL that performs advanced module stomping using VEH to intercept calls, unmap modules during sleep, and remap fresh modules to evade…
0xsp-srd/aetherWindows memory-forensics and threat hunting tool that scans live process memory for malicious patterns, injection techniques, and reflectively loaded…
dump-guy/sc2peSimple dotnet Native AOT app that uses AsmResolver to convert shellcode to PE