boku7

A proof-of-concept Cobalt Strike Reflective Loader which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!

🧙‍♂️ Node.js Command & Control for Script-Jacking Vulnerable Electron Applications

Azure Outlook Command & Control (C2) - Remotely control a compromised Windows Device from your Outlook mailbox. Threat Emulation Tool for North Korean APT InkySquid / ScarCruft / APT37. TTP: Use...

Cobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks by spawning sacrificial process with Arbitrary Code Guard...

Module Stomping, No New Thread, HellsGate syscaller, UUID Shellcode Runner for x64 Windows 10!

Venom C2 is a dependency‑free Python3 Command & Control framework for redteam persistence

Cobalt Strike BOF - Bypass AMSI in a remote process with code injection.

CobaltStrike BOF - Inject ETW Bypass into Remote Process via Syscalls (HellsGate|HalosGate)

EarlyBird process hollowing technique (BOF) - Spawns a process in a suspended state, inject shellcode, hijack main thread with APC, and execute shellcode

Reaping treasures from strings in remote processes memory

x64 Assembly HalosGate direct System Caller to evade EDR UserLand hooks

BOF that finds all the Nt* system call stubs within NTDLL and overwrites with clean syscall stubs (user land hook evasion)

Cobalt Strike Beacon Object File (BOF) that uses handwritten shellcode to return the process Environment strings without touching any DLL's.

64bit Windows 10 shellcode that injects all processes with Meterpreter reverse shells.

A repository of JavaScript XSS attacks against client browsers

Cobalt Strike BOF that uses a custom ASM HalosGate & HellsGate syscaller to return a list of processes

Assembly HellGate implementation that directly calls Windows System Calls and displays the PPID of the explorer.exe process

A recreation of the "Nobelium" malware based on Microsofts Malware analysis - Part 1: PDF2Pwn

Cobalt Strike BOF to list Windows Pipes & return their Owners & DACL Permissions

64bit WIndows 10 shellcode dat pops dat calc - Dynamic & Null Free