Soumyani1

DarkWidow. Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird + Spawns a sacrificial Process as target process + (ACG+BlockDll) mitigation policy on spawned process + PPID spoofing + Api resolving from TIB + API hashing

Learning-EDR-and-EDR_Evasion. I will be uploading all the codes which I created with the help either opensource projects or blogs. This is a step by step EDR learning path for me.

reveng_rtkit. Linux Loadable Kernel Module (LKM) based rootkit (ring-0), capable of hiding itself, processes/implants, rmmod proof, has ability to bypass infamous rkhunter antirootkit.

SharpGmailC2. Our Friendly Gmail will act as Server and implant will exfiltrate data via smtp and will read commands from C2 (Gmail) via imap protocol

ReflectiveNtdll. A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (using pe2shc by @hasherezade). Payload encryption via SystemFucntion033 NtApi and No new thread via Fiber

AMSI-patches-learned-till-now. I have documented all of the AMSI patches that I learned till now

C2_Server. C2 server to connect to a victim machine via reverse shell

DareDevil. Stealthy Loader-cum-dropper/stage-1/stager targeting Windows10

GDB-Cheat-Sheet.

reveng_loader. C# loader capable of running stage-1 from remote url, file path as well as file share

ETW_patches_from_userMode_learned_till_now. ETW patches from userMode learned till now

Executable_Files. Database for custom made as well as publicly available stage-2 or beacons or stageless payloads, used by loaders/stage-1/stagers, or for further usage of C2 as well

AQUARMOURY. My musings in C and offensive tooling

VulnCon-WorkShop-Slides. VulnCon WorkShop - Maldev Workshop : Offensive TradeCraft - Syscalls to Stack Spoofing

Red_Team_Code_Snippets. random code snippets, useful for getting started

BEAR. Bear C2 is a compilation of C2 scripts, payloads, and stagers used in simulated attacks by Russian APT groups, Bear features a variety of encryption methods, including AES, XOR, DES, TLS, RC4, RSA and ChaCha to secure communication between the payload and the operator machine.

Jomungand-HWBP-MemScanEvade. Shellcode Loader with memory evasion

Tartarus-TpAllocInject. C++

KrakenMask. Sleep obfuscation

D1rkSleep. Improved version of EKKO by @5pider that Encrypts only Image Sections

HeapCrypt. Encypting the Heap while sleeping by hooking and modifying Sleep with our own sleep that encrypts the heap

RemoveFalsePositives. Just a small python script which spits out unsigned char representation for Hooked Underlying Ntapis (Which are False Positives) , for c/cpp Usage

Windows-Internals. Important notes and topics on my journey towards mastering Windows Internals

Malware-Detections. Different Malware techniques and windows related attack detections

TryHackMe. THM Walkthroughs

C-for-Everyone-Programming-Fundamentals. All the topics and concepts of C programming that I have learned so far. The things covered in this repo are all beginner-friendly.

CPTS-cheatsheet. HackTheBox Certified Penetration Tester Specialist Cheatsheet

PMD---rad. C++

SleepyCrypt. A shellcode function to encrypt a running process image when sleeping.

StackCrypt. Create a new thread that will suspend every thread and encrypt its stack, then going to sleep , then decrypt the stacks and resume threads

DeepSleep. A variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC

BlockOpenHandle. Block any Process to open HANDLE to your process , only SYTEM is allowed to open handle to your process ,with that you can avoid remote memory scanners

CRTP-CRTE-CRTO. Collection of Notes and CheatSheets used for Red teaming Certs

XRulez-3rd_party_CPP_Libs. A command line tool for creating malicious outlook rules

reveng007.github.io.

.NetConfigLoader-MA. .net config loader

reveng007.