Diego Capriotti

Pyramid. a tool to help operate in EDRs' blind spots

PythonMemoryModule. pure-python implementation of MemoryModule technique to load dll and unmanaged exe entirely from memory

DojoLoader. Generic PE loader for fast prototyping evasion techniques

ProcessStomping. A variation of ProcessOverwriting to execute shellcode on an executable's section

ModuleShifting. Stealthier variation of Module Stomping and Module Overloading injection techniques that reduces memory IoCs. Implemented in Python ctypes

Embedder. Embedder is a collection of sources in different languages to embed Python interpreter with minimal dependencies

talks. Repo containing my public talks

python-bof-runner. Python inline shellcode injector that could be used to run BOFs by leveraging BOF2shellcode

UnhookingPatch. Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime

BouncyGate. HellsGate in Nim, but making sure that all syscalls go through NTDLL.DLL (as in RecycledGate).

DropSpawn_BOF. CobaltStrike BOF to spawn Beacons using DLL Application Directory Hijacking

DInjector. Collection of shellcode injection techniques packed in a D/Invoke weaponized DLL

OffensivePipeline. OffensivePipeline allows to download, compile (without Visual Studio) and obfuscate C# tools for Red Team exercises.

DarkLoadLibrary. LoadLibrary for offensive operations

GregsBestFriend. GregsBestFriend process injection code created from the White Knight Labs Offensive Development course

Packer_Development. Slides & Code snippets for a workshop held @ x33fcon 2024

RWX-Dlls-for-manual-mapping. Here are a few rwx dlls your can use to manual map your cheat dll, they will prob get checked soon...

Havoc-C2-Modification-YARA-Free. POC of modifying YARA signautre for Havoc C2

FilelessRemotePE. Loading Fileless Remote PE from URI to memory with argument passing and ETW patching and NTDLL unhooking and No New Thread technique

FOLIAGE. Public variation of FOLIAGE ( original developer )

grimreaper. A improved memory obfuscation primitive using a combination of special and 'normal' Asynchronous Procedural Calls

TitanLdr. Public variation of Titan Loader

beacon. Former attempt at creating a independent Cobalt Strike Beacon