Kara-4search

NewNtdllBypassInlineHook_CSharp. Load a fresh new copy of ntdll.dll via file mapping to bypass API inline hook.

DInvoke_shellcodeload_CSharp. ShellCodeLoader via DInvoke

SysCall_ShellcodeLoad_Csharp. Load shellcode via syscall

HookDetection_CSharp. HookDetection

MappingInjection_CSharp. MappingInjection via csharp

PEB-PPIDspoofing_Csharp. Command line & PPID spoofing

EarlyBirdInjection_CSharp. Inject shellcode into process via "EarlyBird"

BypassETW_CSharp. Bypassing ETW with Csharp

Fiber_ShellcodeExecution. Using fibers to execute shellcode in a local process via csharp

WindowsEventLogsBypass_Csharp. Bypass windows eventlogs & Sysmon

ThreadHijacking_CSharp. Process inject technique "Thread hijacking" via csharp

HellgateLoader_CSharp. Load shellcode via HELLGATE, Rewrite hellgate with .net framework for learning purpose.

ProcessHollowing_CSharp. ProcessHollowing via csharp

APC_ShellcodeExecution_CSharp. Shellcode Load or execute via "APC technic"

BypassAMSI_CSharp. Bypass AMSI

Simple_ShellCodeLoader_CSharp. A Simple ShellcodeLoader

CreateThreadpoolWait_ShellcodeExecution_CSharp. Shellcode execution via CreateThreadpoolWait with Csharp

FullDLLUnhooking_CSharp. Unhook DLL via cleaning the DLL 's .text section

AddressOfEntryPoint_Hijack_CSharp. Shellcode injection or execution via AddressOfEntryPoint hijack.

JIT_DEMO_Csharp. A little JIT demo to help you understander how JIT works

AMSICheck_CSharp. A tool to detect the integrity of AmsiScanbuffer in memory ，and defend AMSI bypass

WinDefenderKiller. Windows Defender Killer | C++ Code Disabling Permanently Windows Defender using Registry Keys

Terminator. Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes

PPLcontrol. Controlling Windows PP(L)s

ProjectPics. For temp pictures

KernelBypassSharp. C# Kernel Mode Driver to read and write memory in protected processes

defender-detectionhistory-parser. A parser of Windows Defender's DetectionHistory forensic artifact, containing substantial info about quarantined files and executables.

EDRs. C

test. test

DFSCoerce. Python

awesome-browser-exploit. awesome list of browser exploitation tutorials

ScareCrow. ScareCrow - Payload creation framework designed around EDR bypass.

discover. Custom bash scripts used to automate various penetration testing tasks including recon, scanning, parsing, and creating malicious payloads and listeners with Metasploit.

NET-Obfuscate. Obfuscate ECMA CIL (.NET IL) assemblies to evade Windows Defender AMSI

CVE-2021-40444_builders. This repo contain builders of cab file, html file, and docx file for CVE-2021-40444 exploit

LazySign. Create fake certs for binaries using windows binaries and the power of bat files

go-smash. Obfuscate go binaries. 混淆 go 二进制文件中的函数名