CodeXTF2 / OpenMalleableC2Links
Open Source Implementation of Cobalt Strike's Malleable C2
β70Updated this week
Alternatives and similar repositories for OpenMalleableC2
Users that are interested in OpenMalleableC2 are comparing it to the libraries listed below
Sorting:
- PoC framework for Sliver compilationβ22Updated last year
- π§ The ultimate, community-curated resource for Beacon Object Files (BOFs) β tutorials, how-tos, deep dives, and reference materials.β95Updated last month
- Python and BOF utilites to the determine EPA enforcement levels of popular NTLM relay targets from the offensive perspectiveβ164Updated 2 weeks ago
- AI-based Ludus range configuration builderβ29Updated 8 months ago
- ForsHopsβ152Updated 10 months ago
- .NET assembly loader with patchless AMSI and ETW bypass in Rustβ58Updated last year
- β66Updated last month
- Evasion kit for Cobalt Strikeβ28Updated 2 weeks ago
- Stage 0β169Updated last year
- A PoC for Early Cascade process injection technique.β205Updated last year
- Shellcode injection using the Windows Debugging APIβ163Updated 3 weeks ago
- template for developing custom C2 channels for Cobalt Strike using IAT hooks applied by a reflective loader.β99Updated 3 weeks ago
- β125Updated last month
- Generate Secure, Polymorphic, Evasive (lol) Payloadsβ29Updated 3 months ago
- Unauthenticated start EFS service on remote Windows host (make PetitPotam great again)β128Updated 3 months ago
- Local SYSTEM auth trigger for relayingβ167Updated 6 months ago
- Evasive Payload Delivery Server & C2 Redirectorβ112Updated 2 months ago
- Lateral Movement Bof with MSI ODBC Driver Installβ141Updated 4 months ago
- β137Updated 2 months ago
- A Proof-of-Concept using Cache Smuggling + Exif data to passively download a second stage payloadβ50Updated 3 months ago
- Python tool to automatically perform SPN-less RBCD attacks.β112Updated 3 weeks ago
- OAuth Device Code Phishing Toolkitβ108Updated 4 months ago
- adws enumeration bofβ161Updated 3 months ago
- PowerShell toolkit that extracts locked Windows files (SAM, SYSTEM, NTDS, ...) using MFT parsing and raw disk readsβ237Updated 3 months ago
- Lateral Movement as loggedon User via Speech Named Pipe COM & ISpeechNamedPipe + COM Hijackingβ135Updated 6 months ago
- β37Updated 2 months ago
- tool for requesting Entra ID's P2P certificate and authenticating to a remote Entra joinned devices with itβ131Updated 5 months ago
- Flexible LDAP proxy that can be used to inspect & transform all LDAP packets generated by other tools on the fly.β186Updated last month
- comprehensive .NET tool designed to extract and display detailed information about Windows Defender exclusions and Attack Surface Reductiβ¦β212Updated last year
- Bypass user-land hooks by syscall tampering via the Trap Flagβ138Updated 5 months ago