A PoC of User-Defined Reflective Loader for Havoc Framework built with Cystal Palace
☆48Oct 18, 2026Updated 3 weeks ago
Alternatives and similar repositories for DemonLdr
Users that are interested in DemonLdr are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A Beacon Object File (BOF) for Cobalt Strike and Mythic C2 that implements COM hijacking for persistence on Windows systems.☆37Feb 17, 2026Updated 8 months ago
- A Position Independent Code (PIC) implementation of the execute-assembly command built with Crystal Palace.☆22Oct 4, 2026Updated last month
- ☆76Oct 27, 2026Updated last week
- open source implementation of the UDC2 spec used in Cobalt Strike☆62Jul 4, 2026Updated 4 months ago
- OneDrive as a covert C2 transport for Cobalt Strike☆78Sep 19, 2026Updated last month
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- ☆37May 19, 2026Updated 5 months ago
- This is a project aimed to make every other Saas product a C2, confluence is just the beginning.☆23Oct 21, 2026Updated 2 weeks ago
- BOF and research notes from hunting execution paths, covering Shell.HWEventHandlerShellExecute COM execution through the AutoPlay IHWEven…☆39Jun 20, 2026Updated 4 months ago
- Collection of reversed vulnerable drivers weaponized into process killers. PPL won't save you.☆116Oct 18, 2026Updated 3 weeks ago
- Adaptix C2 extender to support Cobalt Strike Malleable C2 profiles☆57Jun 28, 2026Updated 4 months ago
- Repository for various Beacon Object Files (BOFs)☆184Oct 22, 2026Updated 2 weeks ago
- Demonstration of the DLL party process injection technique☆99Oct 1, 2026Updated last month
- A proof of concept that makes a Windows syscall look like it came from a legitimate Windows thread pool, with no trace of your own code a…☆15Jul 15, 2026Updated 3 months ago
- Compose red team infrastructure and Active Directory ranges on a canvas, then compile to a complete Terraform and Ansible working directo…☆176Updated this week
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- PIC shellcode agent based on Stardust framework and Crystal Palace☆93Updated this week
- AdaptixC2 default beacon agent extended to support Crystal Palace loaders.☆66May 4, 2026Updated 6 months ago
- CnaEmulator is a standalone, general-purpose development, emulation, and testing harness for Cobalt Strike Aggressor Scripts (.cna)☆22Sep 20, 2026Updated last month
- ANIMO Azure Network Intel & Mission Ops a C2 based on Azure/Entra assessments☆94Sep 16, 2026Updated last month
- Windows Kernel-Mode Shellcode Development Framework (WKMSDF)☆90Aug 1, 2026Updated 3 months ago
- MemGuard v2.0 (by @prox0959) - Zero-dependency Windows EDR utility: NT kernel handle table auditor, NTDLL syscall hook detector & credent…☆18Oct 24, 2026Updated 2 weeks ago
- ☆34Nov 1, 2026Updated last week
- LPE Proof-of-Concept for Windows 11 abusing TrustedInstaller's Component Based Servicing (CBS) session COM object and junctions for arbit…☆61Nov 1, 2026Updated last week
- Using Just In Time (JIT) instruction decryption, this shellcode loader ensures that only the currently executing instruction is visible i…☆69Apr 2, 2025Updated last year
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- Remote process injection via TP_DIRECT.Callback hijack☆41Oct 30, 2026Updated last week
- Cuban Eight is a red team tool that packages a Windows PE payload into a .wsl file spoofing a real Linux distro installer. Double-click t…☆33Oct 16, 2026Updated 3 weeks ago
- A Beacon Object File (BOF) for Havoc/CS to Bypass PPL and Dump Lsass☆178Sep 22, 2025Updated last year
- Havoc BOF implementation of BYOVD attack to terminate PPL-protected EDR processes using a signed Microsoft kernel driver.☆42Apr 6, 2026Updated 7 months ago
- A listener profile for the Mythic C2 framework that utilizes AI vendors file API's☆30Oct 2, 2026Updated last month
- Tunneling tool for red teaming, designed to run in memory on a windows target and connect back to a Linux VPS so you can proxy tools into…☆54Aug 3, 2026Updated 3 months ago
- Gradually raise the temp of emails/domains!☆14Jul 10, 2026Updated 3 months ago
- A Cobalt Strike BOF implementation of the SilentHarvest registry dumping technique☆184Apr 14, 2026Updated 6 months ago
- ☆72Jul 12, 2026Updated 3 months ago
- Open source password manager - Proton Pass • AdSecurely store, share, and autofill your credentials with Proton Pass, the end-to-end encrypted password manager trusted by millions.
- Transform LDAP filters, BaseDNs, attribute lists, and attribute entries using composable middleware chains. Zero dependencies. Works as a…☆46Apr 13, 2026Updated 6 months ago
- Windows x64 API hashing library that bypasses EAF and resolves forwarded exports, ordinals, and api-ms-*/ext-ms-* API Set DLLs.☆71Oct 7, 2026Updated last month
- Another Injection Technique which eliminates creations of thread in remote process☆29Jul 7, 2026Updated 4 months ago
- Async BOF for NTLMv2 Hash Snooping from ETW☆13Apr 2, 2026Updated 7 months ago
- Proof of Concept for Process Code Injection Without Using WriteProcessMemory☆161Sep 27, 2026Updated last month
- Local Windows credential extraction☆26Jul 14, 2026Updated 3 months ago
- ☆37Sep 6, 2026Updated 2 months ago
Are these results useful?