Tools

rat5ak/cve-2026-50343-installservice-eop

CVE-2026-50343 InstallService StaticPluginMap EoP - standard user to SYSTEM

powershellmafia/powersploit

PowerSploit - A PowerShell Post-Exploitation Framework

monoxgas/srdi

Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

lockedbyte/cve-2021-40444

Generates malicious DOCX documents exploiting CVE-2021-40444 (Microsoft Office RCE) with a hosted server for DLL payload delivery, based on…

7etsuo/windows-api-function-cheatsheets

A reference of Windows API function calls, including functions for file operations, process management, memory management, thread management,…

0x09al/rdpthief

Extracting Clear Text Passwords from mstsc.exe using API Hooking.

nhas/reverse_ssh

SSH-based reverse shell management tool with native SCP/SFTP support, multiple transport protocols, Windows DLL generation, and fileless execution…

egebalci/amber

Reflective PE packer.

outflanknl/c2-tool-collection

A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techniques.

hasherezade/exe_to_dll

Converts a EXE into DLL

med0x2e/sigflip

SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.

optiv/mangle

Mangle is a tool that manipulates aspects of compiled executables (.exe or DLL) to avoid detection from EDRs

bats3c/darkloadlibrary

LoadLibrary for offensive operations

samratashok/admodule

Microsoft signed ActiveDirectory PowerShell module

breenmachine/rottenpotatong

New version of RottenPotato as a C++ DLL and standalone C++ binary - no need for meterpreter or other tools.

tylous/limelighter

A tool for generating fake code signing certificates or signing real ones