HavocFramework / Talon
(Demo) 3rd party agent for Havoc
☆128Updated last year
Related projects ⓘ
Alternatives and complementary repositories for Talon
- ☆175Updated 11 months ago
- Patching AmsiOpenSession by forcing an error branching☆144Updated last year
- Modules used by the Havoc Framework☆204Updated 5 months ago
- You shall pass☆249Updated 2 years ago
- Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from mem…☆110Updated last year
- A BOF to automate common persistence tasks for red teamers☆266Updated last year
- Patch AMSI and ETW☆232Updated 6 months ago
- C# POC to extract NetNTLMv1/v2 hashes from ETW provider☆250Updated last year
- Porting of BOF InlineExecute-Assembly to load .NET assembly in process but with patchless AMSI and ETW bypass using hardware breakpoint.☆155Updated last year
- CobaltStrike BOF to spawn Beacons using DLL Application Directory Hijacking☆216Updated last year
- A collection of various and sundry code snippets that leverage .NET dynamic tradecraft☆135Updated 6 months ago
- A Stealthy Lsass Dumper - can abuse ProcExp152.sys driver to dump PPL Lsass, no dbghelp.lib calls.☆313Updated last year
- CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files (BOF) for Cobalt Strike to perform process inject…☆227Updated last year
- Useful Cobalt Strike BOFs found or used during engagements☆131Updated last year
- ☆155Updated 3 months ago
- BOF combination of KillDefender and Backstab☆156Updated last year
- Simple PoC Python agent to showcase Havoc C2's custom agent interface. Not operationally safe or stable. Released with accompanying blog …☆78Updated last year
- Havoc C2 profile generator☆57Updated 3 weeks ago
- ☆146Updated last year
- different ntdll unhooking techniques : unhooking ntdll from disk, from KnownDlls, from suspended process, from remote server (fileless)☆175Updated last year
- Weaponized HellsGate/SigFlip☆194Updated last year
- Execute shellcode files with rundll32☆184Updated 9 months ago
- A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (…☆165Updated last year
- reflectively load and execute PEs locally and remotely bypassing EDR hooks☆148Updated 10 months ago
- A BOF to determine Windows Defender exclusions.☆240Updated last year
- C# havoc implant☆96Updated last year
- Lateral Movement Using DCOM and DLL Hijacking☆281Updated last year