Reaping treasures from strings in remote processes memory

BOF that finds all the Nt* system call stubs within NTDLL and overwrites with clean syscall stubs (user land hook evasion)

A proof-of-concept Cobalt Strike Reflective Loader which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!

Blog

Azure Outlook Command & Control (C2) - Remotely control a compromised Windows Device from your Outlook mailbox. Threat Emulation Tool for North Korean APT InkySquid / ScarCruft / APT37. TTP: Use Mi…

Cobalt Strike Beacon Object File (BOF) that uses handwritten shellcode to return the process Environment strings without touching any DLL's.

Repo for SLAE64 Exam

GetSimple CMS My SMTP Contact Plugin <= v1.1.1 - CSRF to RCE

GetSimple CMS Custom JS Plugin Exploit RCE Chain

64bit WIndows 10 shellcode dat pops dat calc - Dynamic & Null Free

x64 Assembly HalosGate direct System Caller to evade EDR UserLand hooks

Assembly HellGate implementation that directly calls Windows System Calls and displays the PPID of the explorer.exe process

Cobalt Strike BOF that uses a custom ASM HalosGate & HellsGate syscaller to return a list of processes

Cobalt Strike BOF - Bypass AMSI in a remote process with code injection.

64bit Windows 10 shellcode that injects all processes with Meterpreter reverse shells.

Cobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks by spawning sacrificial process with Arbitrary Code Guard (AC…

Module Stomping, No New Thread, HellsGate syscaller, UUID Shellcode Runner for x64 Windows 10!

A recreation of the "Nobelium" malware based on Microsofts Malware analysis - Part 1: PDF2Pwn

Cobalt Strike BOF to list Windows Pipes & return their Owners & DACL Permissions

EarlyBird process hollowing technique (BOF) - Spawns a process in a suspended state, inject shellcode, hijack main thread with APC, and execute shellcode