BlackSnufkin / BYOVD

Related projects ⓘ

Alternatives and complementary repositories for BYOVD

• Cobalt-Strike / bof-vs
  A Beacon Object File (BOF) template for Visual Studio
  ☆140Updated 3 months ago
• naksyn / DojoLoader
  Generic PE loader for fast prototyping evasion techniques
  ☆185Updated 4 months ago
• 0xHossam / HuffLoader
  Huffman Coding in Shellcode Obfuscation & Dynamic Indirect Syscalls Loader
  ☆85Updated 8 months ago
• WKL-Sec / LayeredSyscall
  Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR …
  ☆194Updated 3 months ago
• VoldeSec / PatchlessCLRLoader
  .NET assembly loader with patchless AMSI and ETW bypass
  ☆278Updated last year
• Maldev-Academy / GhostlyHollowingViaTamperedSyscalls
  Implementing the ghostly hollowing PE injection technique using tampered syscalls.
  ☆125Updated 5 months ago
• oldboy21 / RflDllOb
  Reflective DLL Injection Made Bella
  ☆200Updated last month
• lsecqt / ThreadlessInject-C-Implementation
  This repository implements Threadless Injection in C
  ☆154Updated 10 months ago
• MalwareTech / EDRception
  A proof of concept for abusing exception handlers to hook and bypass user mode EDR hooks.
  ☆171Updated 10 months ago
• vxCrypt0r / AMSI_VEH
  A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, f…
  ☆148Updated 5 months ago
• reveng007 / ReflectiveNtdll
  A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (…
  ☆165Updated last year
• ProcessusT / Venoma
  Yet another C++ Cobalt Strike beacon dropper with Compile-Time API hashing and custom indirect syscalls execution
  ☆164Updated 8 months ago
• xrombar / flower
  a modified CONTEXT based ropchain to circumvent CFG-FindHiddenShellcode and EtwTi-FluctuationMonitor
  ☆95Updated 7 months ago
• Offensive-Panda / RWX_MEMEORY_HUNT_AND_INJECTION_DV
  Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.
  ☆244Updated 5 months ago
• CICADA8-Research / COMThanasia
  A set of programs for analyzing common vulnerabilities in COM
  ☆154Updated 2 months ago
• ipSlav / DirtyCLR
  An App Domain Manager Injection DLL PoC on steroids
  ☆161Updated 11 months ago
• itm4n / PPLrevenant
  Bypass LSA protection using the BYODLL technique
  ☆146Updated 2 months ago
• Octoberfest7 / enumhandles_BOF
  ☆116Updated 2 months ago
• keowu / BadRentdrv2
  A vulnerable driver exploited by me (BYOVD) that is capable of terminating several EDRs and antivirus software in the market, rendering t…
  ☆89Updated 4 months ago
• JanielDary / ImmoralFiber
  Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) Phan…
  ☆209Updated 2 months ago
• xalicex / Killers
  Exploitation of process killer drivers
  ☆188Updated last year
• Maldev-Academy / Christmas
  ☆245Updated 10 months ago
• SaadAhla / D1rkInject
  Another approach of Threadless injection discovered by @_EthicalChaos_ in c that loads a module into the target process and stomps it, an…
  ☆174Updated last year
• klezVirus / RpcProxyInvoke
  Simple POC library to execute arbitrary calls proxying them via NdrServerCall2 or similar
  ☆117Updated 3 months ago
• safedv / RustVEHSyscalls
  Rust port of LayeredSyscall, designed to perform indirect syscalls while generating legitimate API call stack frames by abusing Vectored …
  ☆101Updated 3 weeks ago
• florylsk / NtRemoteLoad
  Remote Shellcode Injector
  ☆204Updated last year
• 0xEr3bus / PoolPartyBof
  A beacon object file implementation of PoolParty Process Injection Technique.
  ☆324Updated 11 months ago
• senzee1984 / InflativeLoading
  Dynamically convert an unmanaged EXE or DLL file to PIC shellcode by prepending a shellcode stub.
  ☆266Updated 7 months ago