outflanknl

Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.

A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.

LSASS memory dumper using direct system calls and API unhooking.

A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techniques.

Automated deployment of Windows and Active Directory test lab networks. Useful for red and blue teams.

Tool to create hidden registry keys.

A Cobalt Strike tool to audit Active Directory user accounts for weak, well known or easy guessable passwords.

Ps-Tools, an advanced process monitoring toolkit for offensive operations

Recon-AD, an AD recon tool based on ADSI and reflective DLL’s

PowerShell and Cobalt Strike scripts for lateral movement using Excel 4.0 / XLM macros via DCOM (direct shellcode injection in Excel.exe)

Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF)

Small scripts that make life better

Tools for analyzing EDR agents

A Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific loaded modules or process handles.

Zipper, a CobaltStrike file and folder compression utility.

A Beacon Object File (BOF) for Cobalt Strike which uses direct system calls to enable WDigest credential caching.

Agressor script that lists available Cobalt Strike beacon commands and colors them based on their type

Presentation material presented by Outflank team members at public events.

PoC to demonstrate how CLR ETW events can be tampered.

Example DLL to load from Windows NetShell

.NET implementation of Get-GPPPassword. Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.

Recover NT hashes from NetNTLMv1 responses using local WebGPU computation and local/remote table lookup

POC for Cobalt Strike external C2

Position-independent Reflective Loader for macOS

Beacon Object File (BOF) Template

Parses cached certificate templates from a Windows Registry file and displays them in the same style as Certipy does

Linux Process Injection via Seccomp Notifier

Code for blogpost: https://outflank.nl/blog/2018/10/25/building-resilient-c2-infrastructues-using-dns-over-https/

Modify managed functions from unmanaged code

Info related to the Outflank training: Microsoft Office Offensive Tradecraft