
unicorn
Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's powershell…

Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's powershell…

Apply a divide and conquer approach to bypass EDRs

This novel way of using NtQueueApcThreadEx by abusing the ApcRoutine and SystemArgument[0-3] parameters by passing a random pop r32; ret gadget can…

Windows 10 DLL Injector via Driver utilizing VAD and hiding the loaded driver

Shellcode injection technique. Given as C++ header, standalone Rust program or library.


PoC demonstrating a multi process injection chain aimed at remotely executing shellcode

Script to exploit CVE-2023-38035

Reverse Shell Detection with Machine Learning

Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers.

PoCs and tools for investigation of Windows process execution techniques

A technique that can be used to bypass AV/EDR memory scanners. This can be used to hide well-known and detected shellcodes (such as msfvenom) by…


Adversary Emulation Framework

This repo contains C/C++ snippets that can be handy in specific offensive scenarios.

Modern PIC implant for Windows (64 & 32 bit)

ROP ROCKET is an advanced code-reuse attack framework, with extensive ROP chain generation capabilities, including for novel Windows Syscalls attack,…

Emulate and Dissect MSF and *other* attacks