̷K̷i̷r̷k̷ ̷T̷r̷y̷c̷h̷e̷l̷

Tempest. A command and control framework written in rust.

moonwalk. find dll base addresses without PEB WALK

stargate. Locate dlls and function addresses without PEB Walk and EAT parsing

mal_ex. Source code for complete MALicious softWARE books I & II

noldr. Dynamically resolve API function addresses at runtime in a secure manner.

pool_party_rs. remote process injections using pool party techniques

phantom_persist_rs. Rust implementation of phantom persistence technique documented in https://blog.phantomsec.tools/phantom-persistence

early_cascade_inj_rs. early cascade injection PoC based on Outflanks blog post, in rust

snapinject_rs. A remote process injection using process snapshotting based on https://gitlab.com/ORCA000/snaploader , in rust. It creates a sacrificial process, takes a snapshot of the process, and injects shellcode into it.

schtask. Rust implementation, creating a scheduled task programmatically with user logon trigger.

dll2shell. converts sRDI compatible dlls to shellcode

Red_Team_Rust. Collection of Rust repos useful for Red Teamers.

hollow_rs. A Rust PoC implementation of the Early Bird process hollowing technique, inspired by https://github.com/boku7/HOLLOW.

rpeloader. use python on windows with full submodule support without installation

byont. bring your own clean ntdll (or other MS dlls)

nt_unhooker. demo unhooking functions in ntdll

dev. maldev obviously

NtCreateUserProcess_rs. example using NtCreateUserProcess in rust

rust_api_demo. various methods of making API calls

rekkoex. Rust

openai. Red Team Projects with chat.openai.com.

rust_template. Rust

rpi. rust library for performing remote process injection, originally written for use in Tempest c2 project

debug_inject_rs. Rust

rust_pyramid. Rust project that leverages the signed embeddable python package to evade EDR.

RustySpy. A powerful Windows UI monitoring and DNS exfiltration tool written in Rust, combining advanced UI event capture capabilities with secure data exfiltration and EDR suppression features.

rusternals. A rust code notebook for working with windows internals.

offensiveswift. Swift

NomadLoader. An advanced utility for converting Windows Portable Executable (PE) files to position-independent code (PIC) shellcode. It enables executable content to be executed from any memory location without requiring traditional loading or relocation.

macdev. maldev but for mac

Rust-for-Malware-Development. This repository contains my complete resources and coding practices for malware development using Rust 🦀.

Supernova. Real fucking shellcode encryptor & obfuscator tool

rustpivotclient. just the client

PhantomKeystroke. An advanced attribution deception tool that adds subtle, region-specific fingerprints to command-line operations to mislead forensic analysis. It seamlessly integrates with C2 frameworks and provides realistic keyboard patterns from different regions while maintaining full command functionality.

MalDev-Analyzer-MCP. Built for red teamers, by red teamers - an MCP tool for malware development, OPSEC testing, and supporting custom loader design during red team engagements.

Shelter. ROP-based sleep obfuscation to evade memory scanners

x64asm. Learning x64 assembly with MASM

RustPivot. Reverse SOCKS5 Proxy Written in Rust

dll-builder. Creates a DLL that runs a payload once injected into a process.

shellcode-plain-sight. Hiding shellcode in plain sight within a large memory region. Inspired by technique used by Raspberry Robin's Roshtyak

Snapshotting_rs. Rust

kernel-callback-removal. kernel callback removal (Bypassing EDR Detections)

azure_scripts. Scripts for attacking azure

windows-XP-SP1. 网上泄露的Windows XP SP1 source code

FaceDancer. FaceDancer is an exploitation tool aimed at creating hijackable, proxy-based DLLs by taking advantage of COM-based system DLL image loading

rust-remote-injection-nix. Shellcode injection to a remote linux process in rust

RustVEHSyscalls. Rust port of LayeredSyscall, designed to perform indirect syscalls while generating legitimate API call stack frames by abusing Vectored Exception Handling (VEH) to bypass user-land EDR hooks in Windows.

srdi-rs. Rusty Shellcode Reflective DLL Injection (sRDI)

turnt. A tool designed for smuggling interactive command and control traffic through legitimate TURN servers hosted by reputable providers such as Zoom.

reloader. Reflective DLL self-loading as a library

pdfdropper. PDF dropper Red Team Scenairos