CodeXTF2 / OpenMalleableC2Links
Open Source Implementation of Cobalt Strike's Malleable C2
☆70Updated this week
Alternatives and similar repositories for OpenMalleableC2
Users that are interested in OpenMalleableC2 are comparing it to the libraries listed below
Sorting:
- PoC framework for Sliver compilation☆22Updated last year
- 🧠 The ultimate, community-curated resource for Beacon Object Files (BOFs) — tutorials, how-tos, deep dives, and reference materials.☆95Updated last month
- Python and BOF utilites to the determine EPA enforcement levels of popular NTLM relay targets from the offensive perspective☆164Updated 2 weeks ago
- AI-based Ludus range configuration builder☆29Updated 8 months ago
- ForsHops☆152Updated 10 months ago
- .NET assembly loader with patchless AMSI and ETW bypass in Rust☆58Updated last year
- ☆66Updated last month
- Evasion kit for Cobalt Strike☆28Updated 2 weeks ago
- Stage 0☆169Updated last year
- A PoC for Early Cascade process injection technique.☆205Updated last year
- Shellcode injection using the Windows Debugging API☆163Updated 3 weeks ago
- template for developing custom C2 channels for Cobalt Strike using IAT hooks applied by a reflective loader.☆99Updated 3 weeks ago
- ☆125Updated last month
- Generate Secure, Polymorphic, Evasive (lol) Payloads☆29Updated 3 months ago
- Unauthenticated start EFS service on remote Windows host (make PetitPotam great again)☆128Updated 3 months ago
- Local SYSTEM auth trigger for relaying☆167Updated 6 months ago
- Evasive Payload Delivery Server & C2 Redirector☆112Updated 2 months ago
- Lateral Movement Bof with MSI ODBC Driver Install☆141Updated 4 months ago
- ☆137Updated 2 months ago
- A Proof-of-Concept using Cache Smuggling + Exif data to passively download a second stage payload☆50Updated 3 months ago
- Python tool to automatically perform SPN-less RBCD attacks.☆112Updated 3 weeks ago
- OAuth Device Code Phishing Toolkit☆108Updated 4 months ago
- adws enumeration bof☆161Updated 3 months ago
- PowerShell toolkit that extracts locked Windows files (SAM, SYSTEM, NTDS, ...) using MFT parsing and raw disk reads☆237Updated 3 months ago
- Lateral Movement as loggedon User via Speech Named Pipe COM & ISpeechNamedPipe + COM Hijacking☆135Updated 6 months ago
- ☆37Updated 2 months ago
- tool for requesting Entra ID's P2P certificate and authenticating to a remote Entra joinned devices with it☆131Updated 5 months ago
- Flexible LDAP proxy that can be used to inspect & transform all LDAP packets generated by other tools on the fly.☆186Updated last month
- comprehensive .NET tool designed to extract and display detailed information about Windows Defender exclusions and Attack Surface Reducti…☆212Updated last year
- Bypass user-land hooks by syscall tampering via the Trap Flag☆138Updated 5 months ago