This contains a number of examples demonstrating how to use callback functions in supported aggressor script functions
☆38Mar 17, 2025Updated 11 months ago
Alternatives and similar repositories for callback_examples
Users that are interested in callback_examples are comparing it to the libraries listed below
Sorting:
- Windows RPC example calling stubs generated from MS-LSAT and MS-LSAD☆28Jan 4, 2024Updated 2 years ago
- A Beacon Object File (BOF) template for Visual Studio☆269Nov 24, 2025Updated 3 months ago
- GhostLoader - AppDomainManager - Injection - 攻壳机动队☆53May 21, 2020Updated 5 years ago
- 获取chrome 浏览器记录☆43Sep 6, 2025Updated 5 months ago
- ☆17Aug 25, 2022Updated 3 years ago
- ☆60Jan 9, 2023Updated 3 years ago
- Code snippets to add on top of cobalt strike sleepmask kit so that ekko can work in a CFG protected process☆49Mar 15, 2023Updated 2 years ago
- A simple BOF that frees UDRLs☆122May 29, 2022Updated 3 years ago
- CLIPBRDWNDCLASS process injection technique(BOF) - execute beacon shellcode in callback☆68Sep 15, 2022Updated 3 years ago
- Click Once + App Domain☆64Updated this week
- Simple BOF to read the protection level of a process☆118May 10, 2023Updated 2 years ago
- Cobalt Strike Beacon Object File (BOF) that uses LogonUserSSPI API to perform kerberos-based password spray☆47Mar 4, 2023Updated 2 years ago
- ☆57Apr 19, 2023Updated 2 years ago
- An example of how a driver can register a handle creation callback.☆16Jun 12, 2023Updated 2 years ago
- ☆16Apr 21, 2023Updated 2 years ago
- 🐚ᴠʟᴀɴɢ ʀᴇᴠᴇʀsᴇ sʜᴇʟʟ🐚☆11Apr 28, 2022Updated 3 years ago
- A method to execute shellcode using RegisterWaitForInputIdle API.☆55Apr 4, 2023Updated 2 years ago
- ☆129Jun 28, 2023Updated 2 years ago
- DLL Exports Extraction BOF with optional NTFS transactions.☆90Nov 5, 2021Updated 4 years ago
- Cobalt Strike Beacon Object File (BOF) that obtain SYSTEM privilege with SeImpersonate privilege by passing a malicious IUnknwon object t…☆96Mar 20, 2023Updated 2 years ago
- Small utility package for manipulating Windows process tokens☆26Apr 26, 2022Updated 3 years ago
- Parses Cobalt Strike malleable C2 profiles.☆61Updated this week
- My personal collection of webshells for educational purposes. Most are custom implementations/adaptations of stuff I found on the interne…☆21May 20, 2024Updated last year
- Script to use SysWhispers2 direct system calls from Cobalt Strike BOFs☆125May 24, 2022Updated 3 years ago
- Strstr with user-supplied needle and filename as a BOF.☆32Sep 27, 2021Updated 4 years ago
- ☆12Oct 9, 2020Updated 5 years ago
- Modified versions of the Cobalt Strike Process Injection Kit☆106Jan 24, 2024Updated 2 years ago
- An aggressor script for Cobalt Strike to query Windows' GetLastError messages☆18Sep 25, 2022Updated 3 years ago
- ☆44Oct 16, 2023Updated 2 years ago
- Cobalt Strike Beacon Object Files☆167May 2, 2022Updated 3 years ago
- Cobalt Strike Beacon Object File for bypassing UAC via the CMSTPLUA COM interface.☆215Oct 9, 2022Updated 3 years ago
- It stinks☆105Apr 22, 2022Updated 3 years ago
- ☆71Sep 17, 2020Updated 5 years ago
- Load a dynamic library from memory by modifying the native Windows loader☆285Jun 18, 2025Updated 8 months ago
- power-kill is a project that kill protected processes (such as EDR or AV) by injecting shellcode into high privilege processes☆48Sep 27, 2021Updated 4 years ago
- Beacon Object File to locate and suspend the threads hosting the Event Log service☆29Jun 17, 2022Updated 3 years ago
- A firebeam plugin that exploits the CVE-2024-26229 vulnerability to perform elevation of privilege from a unprivileged user☆40Aug 15, 2024Updated last year
- A .NET Runtime for Cobalt Strike's Beacon Object Files☆90Oct 13, 2024Updated last year
- Cobalt Strike beacon object file implementation for trusted path UAC bypass. The target executable will be called without involving "cmd.…☆146Aug 16, 2021Updated 4 years ago