mgeeky

A collection of more than 170+ tools, scripts, cheatsheets and other loots that I've developed over years for Red Teaming/Pentesting/IT Security audits purposes.

Thread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation from scanners and analysts.

A PoC that packages payloads into output containers to evade Mark-of-the-Web flag & demonstrate risks associated with container file formats. Supports: ZIP, 7zip, PDF, ISO, IMG, CAB, VHD, VHDX

An advanced in-memory evasion technique fluctuating shellcode's memory protection between RW/NoAccess & RX and then encrypting/decrypting its contents

My collection of battle-tested Aggressor Scripts for Cobalt Strike 4.0+

Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking, IOCs collection & PE Backdooring. You feed it...

Cobalt Strike C2 Reverse proxy that fends off Blue Teams, AVs, EDRs, scanners through packet inspection and malleable profile correlation

A script that helps you understand why your E-Mail ended up in Spam

OpSec-safe Powershell runspace from within C# (aka SharpPick) with AMSI, Constrained Language Mode and Script Block Logging disabled at startup

Cobalt Strike User-Defined Reflective Loader with AV/EDR Evasion in mind

Apache Tomcat auto WAR deployment & pwning penetration testing tool.

UnhookMe is an universal Windows API resolver & unhooker addressing problem of invoking unmonitored system calls from within of your Red Teams malware

Red Team oriented C# Simple HTTP & WebDAV Server with Net-NTLM hashes capture functionality

MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.

AzureRT - A Powershell module implementing various Azure Red Team tactics

Bad Characters highlighter for exploit development purposes supporting multiple input formats while comparing.

A bunch of my exploit development helper tools, collected in one place.

Visual Basic Code universal Obfuscator intended to be used during penetration testing assignments.

This is a rich-featured Visual Basic macro code for use during Penetration Testing assignments, implementing various advanced post-exploitation techniques.

Proof of Concept code and samples presenting emerging threat of MSI installer files.

Lightweight Portable Executable parsing library and a demo peParser application.

SysInternals' Process Monitor filters repository - collected from various places and made up by myself. To be used for quick Behavioral analysis of testing specimens. Inspired and based on Lenny...

Exploits pack for the Windows Kernel mode driver HackSysExtremeVulnerableDriver written for educational purposes.

PHP Script intdended to be used during Phishing campaigns as a credentials collector linked to backdoored HTML <form> action parameter