mobdk

CopyCat. Simple rapper for Mimikatz, bypass Defender

Upsilon. Upsilon execute shellcode with syscalls - no API like NtProtectVirtualMemory is used

CloneProcess. Clone running process with ZwCreateProcess

Zeta. Using "svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc" as trigger

WinBoost. Execute Mimikatz with different technique

Core. Core bypass Windows Defender and execute any binary converted to shellcode

HideCode. Hide code from dnSpy and other C# spying tools

CoreClass. Mimikatz embedded as classes

WinSpoof. Use TpAllocWork, TpPostWork and TpReleaseWork to execute machine code

NewShell. Reverse shell without Windows cmd.exe, using ReactOS cmd.dll as shellcode

Sigma. Execute shellcode with ZwCreateSection, ZwMapViewOfSection, ZwOpenProcess, ZwMapViewOfSection and ZwCreateThreadEx

winNoise. Execute embedded Mimikatz

ExecuteShellcodeWithSyscalls. Execute shellcode with syscalls from C# .dll

VBA-DLL-WMI-EXECUTION. Call your own DLL from VBA and execute code under process svchost.exe with WMI

zCore. Optimized version, Nt/ZwProtectVirtualMemory has been removed with every syscall.

CallBack. Execute Mimikatz in shellcode format, uses native API VirtualAlloc and EnumSystemGeoID

compilecs. Use build-in compiler csc.exe and other tools to insert entrypoint

LoadDLLFromFileAndConvertToShellcode. Load DLL or EXE file and convert to shellcode at runtime

WinTimer. Wrapper for Mimikatz with delayed execution

FiberShellcodeSyscall. Using syscall when possible, ZwAllocateVirtualMemory, ZwProtectVirtualMemory and ZwWriteVirtualMemory

Files. HTML

MimiRunner. Run Mimikatz with ReactOS cmd.exe

RemoteCat. C#

ObfuscateTest. Obfuscate C# source code, so the relationship between the definition and the function call, cannot be detected (not at runtime)

NewShellCS. Execute reverse shell without cmd.exe and uses syscalls from C#

InjectShellcodeWithAPC. Simple yet effective shellcode injection with QueueUserAPC

HijackCS. Hijack your own process or other, use syscall NtWriteVirtualMemory and NtAllocateVirtualMemory to stay undetected

CSharpInlineAssembly. Execute inline assembly from C#

DLLloaderCS. Load 32bit .DLL payload fra C#

SVCHOSTEXE. Execute shellcode with svchost.exe -k LocalSystemNetworkResticted

Epsilon. In this PoC I am addressing the timer issue that exist in Defender

ExecuteVBAwithRtlMoveMemory. Execute your VBA macro with RtlMoveMemory only

Omega. Use syscalls ZwCreateSection and ZwMapViewOfSection and GetDelegateForFunctionPointer

APCinjectCS. Simple shellcode injetion with APC and syscalls

ProtectingCodeWith-MITIGATION_POLICY. Protect your code with a mitigation policy that prevent non Microsoft signed code to inject for inspection

ShellcodeAndSvchost. Inject your shellcode into svchost

ClassAsShellcode. This PoC uses C# Class name as shellcode

CSharpPowershellRunspace. Inject 64 bit .dll from CSharp and Powershell runspace

TCPClientReverseShellCS. C# reverse shell using TCPClient

WordVBAPayload. Create Word VBA payload that self-destruction at runtime

InstallutilInject. Execute .dll with MS InstallUtil.exe

TriggerExecutionTasks. Trigger execution of tasks.dll from C# calling embedded JavaScript

Shellcode. Alternative version

ProcessFinder. Find process and startup arguments with syscalls

VBAShellCodeCallFuncInDLL.

SimpleCodeExecution. Execute tasks.dll with minimum of code

DllHijackCS. .DLL based hijack

FiberShellcode. Execute shellcode with Fiber

BinBAT. Create payload that is both binary and batch file at the same time (Windows)

PoolWorker. Use CreateThreadpoolWork to execute shellcode