Persistence by writing/reading shellcode from Event Log. Usage The SharpEventPersist tool takes 4 case-sensitive parameters: -file “C:\path\to\shellcode.bin” -instanceid 1337 -source …
RCLocals – Linux Startup Analyzer
Inspired by ‘Autoruns’ from Sysinternals, RCLocals analyzes all Linux startup possibilities to find backdoors, also performs process integrity verification, scan …
Nosferatu – Lsass NTLM Authentication Backdoor
Lsass NTLM Authentication Backdoor How it Works First, the DLL is injected into the lsass.exe process, and will begin hooking …
DarkLoadLibrary – LoadLibrary For Offensive Operations
LoadLibrary for offensive operations. How does is work? https://www.mdsec.co.uk/2021/06/bypassing-image-load-kernel-callbacks/ Usage<div class="highlight highlight-source-c position-relative" data-snippet-clipboard-copy-content="DARKMODULE DarkModule = DarkLoadLibrary( LOAD_LOCAL_FILE, // control …
FalconEye – Real-time detection software for Windows process injections
FalconEye is a windows endpoint detection software for real-time process injections. It is a kernel-mode driver that aims to catch …
MoveKit – Cobalt Strike Kit For Lateral Movement
Movekit is an extension of built in Cobalt Strike lateral movement by leveraging the execute_assembly function with the SharpMove and …
Cooolis-ms – A Server That Supports The Metasploit Framework RPC
Cooolis-ms is a server that supports Metasploit Framework RPC. It is used to work for Shellcode and PE loader, bypassing …
SitRep – Extensible, Configurable Host Triage
SitRep is intended to provide a lightweight, extensible host triage alternative. Checks are loaded dynamically at runtime from stand-alone files. …
DLInjector-GUI – DLL Injector Graphical User Interface
DLInjector for Graphical User Interface.Faster DLL Injector for processes. It targets the process name to identify the target. The process …
TrustJack – Yet Another PoC For Hijacking DLLs in Windows
Yet another PoC for https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windowsBlogpost: https://redteamer.tips/?p=108To be used with a cmd that does whatever the F you want, for a …