Loading Fileless Remote PE from URI to memory with argument passing and ETW patching and NTDLL unhooking and No New Thread technique
☆78Sep 29, 2022Updated 4 years ago
Alternatives and similar repositories for FilelessRemotePE
Users that are interested in FilelessRemotePE are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- malleable profile generator GUI for Havoc☆54Apr 28, 2023Updated 3 years ago
- ☆12Apr 5, 2024Updated 2 years ago
- A manual PE mapping implementation, aka reflective loader☆25Feb 28, 2026Updated 8 months ago
- Titan: A generic user defined reflective DLL for Cobalt Strike☆84Nov 20, 2022Updated 3 years ago
- ☆15Aug 17, 2023Updated 3 years ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- Terminate AV/EDR Processes using kernel driver☆354Jun 12, 2023Updated 3 years ago
- Shellcode loader that hides payload within Egyptian hieroglyphic Unicode characters (U+13000 plane) to evade detection. It decodes the gl…☆16Nov 20, 2025Updated 11 months ago
- A POC of a new “threadless” process injection technique that works by utilizing the concept of DLL Notification Callbacks in local and re…☆469Aug 23, 2023Updated 3 years ago
- This script is used to bypass DLL Hooking using a fresh mapped copy of ntdll file, patch the ETW and trigger a shellcode with process hol…☆74Feb 11, 2024Updated 2 years ago
- CobaltStrike BOF to spawn Beacons using DLL Application Directory Hijacking☆284Jun 8, 2023Updated 3 years ago
- Beacon compiled using clang☆70Jan 22, 2023Updated 3 years ago
- goon，是一款基于golang开发的扫描工具，暂时支持portscan、webscan、titlescan、dirscan、fofascan、pluginscan等模块功能，当然也支持将这些模块联动起来的autoscan。后期也会慢慢加入其他零件模块，感谢您的使用，也希望…☆10Jun 28, 2021Updated 5 years ago
- An easily modifiable shellcode template for Windows x64 written in C☆273Jun 14, 2023Updated 3 years ago
- PE Sections Packer + Loader for Windows - Packs a DLL/EXE file and maps it into the loader (C/C++)☆16Oct 19, 2025Updated last year
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (…☆178Feb 10, 2023Updated 3 years ago
- this script adds the ability to encode shellcode (.bin) in XOR,chacha20, AES. You can choose between 2 loaders (Myph / 221b)☆83Dec 20, 2023Updated 2 years ago
- Cobalt Strike Malleable Profile Inline Patch Template: A Position Independent Code (PIC) Code Template For Creating Shellcode That Can Be…☆43Sep 3, 2020Updated 6 years ago
- Process hollowing injection technique for Red Team operations☆19Sep 18, 2023Updated 3 years ago
- PoC for downloading data by injecting into processes to evade firewalls☆35Nov 29, 2025Updated 11 months ago
- About C# loader that copies a chunk at the time of the shellcode in memory in a suspended process, rather that all at once☆12Jul 14, 2022Updated 4 years ago
- ☆113Feb 17, 2025Updated last year
- Bypass Malware Sandbox Evasion Ram check☆140Jan 3, 2023Updated 3 years ago
- Creation and removal of Defender path exclusions and exceptions in C#.☆31Nov 1, 2023Updated 2 years ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- Shellcode Loader Implementing Indirect Dynamic Syscall , API Hashing, Fileless Shellcode retrieving using Winsock2☆298Jul 15, 2023Updated 3 years ago
- havoc2nginx is a simple python script that converts Havoc Framework's yaotl malleable c2 profile to Nginx configuration file format. Most…☆12May 8, 2023Updated 3 years ago
- Privileger is a tool to work with Windows Privileges☆138Feb 7, 2023Updated 3 years ago
- A cross platform tool to work with keytab files used by Kerberos to store authentication information.☆13Oct 9, 2026Updated 3 weeks ago
- The code is a pingback to the Dark Vortex blog: https://0xdarkvortex.dev/hiding-memory-allocations-from-mdatp-etwti-stack-tracing/☆220Jan 29, 2023Updated 3 years ago
- Hide your P/Invoke signatures through other people's signed assemblies☆215Mar 10, 2024Updated 2 years ago
- Execute unmanaged Windows executables in CobaltStrike Beacons☆722Mar 4, 2023Updated 3 years ago
- Create a new thread that will suspend every thread and encrypt its stack, then going to sleep , then decrypt the stacks and resume thread…☆167Aug 2, 2023Updated 3 years ago
- ☆42Jul 10, 2023Updated 3 years ago
- Bare Metal GPUs on DigitalOcean Gradient AI • AdPurpose-built for serious AI teams training foundational models, running large-scale inference, and pushing the boundaries of what's possible.
- Replace the .txt section of the current loaded modules from \KnownDlls\☆308Sep 28, 2022Updated 4 years ago
- A C# Tool to gather information about email breaches☆17Dec 21, 2023Updated 2 years ago
- 无影脚 - 命令行下的日志文件处理工具☆49Nov 15, 2022Updated 3 years ago
- Another approach of Threadless injection discovered by @_EthicalChaos_ in c that loads a module into the target process and stomps it, an…☆189Aug 2, 2023Updated 3 years ago
- Bypassing UAC with SSPI Datagram Contexts☆472Sep 24, 2023Updated 3 years ago
- A Stealthy Lsass Dumper - can abuse ProcExp152.sys driver to dump PPL Lsass, no dbghelp.lib calls.☆326Jan 31, 2023Updated 3 years ago
- Shellcode Loader with Indirect Dynamic syscall Implementation , shellcode in MAC format, API resolving from PEB, Syscall calll and syscal…☆322Aug 2, 2023Updated 3 years ago