LloydLabs / shellcode-plain-sight
Hiding shellcode in plain sight within a large memory region. Inspired by technique used by Raspberry Robin's Roshtyak
☆173Updated last year
Related projects ⓘ
Alternatives and complementary repositories for shellcode-plain-sight
- Run Your Payload Without Running Your Payload☆176Updated 2 years ago
- A proof of concept for abusing exception handlers to hook and bypass user mode EDR hooks.☆168Updated 10 months ago
- Infect Shared Files In Memory for Lateral Movement☆192Updated last year
- Exploitation of process killer drivers☆186Updated last year
- A variation of ProcessOverwriting to execute shellcode on an executable's section☆145Updated 10 months ago
- ☆173Updated 11 months ago
- Do some DLL SideLoading magic☆74Updated last year
- Your syscall factory☆122Updated last month
- ☆133Updated last year
- EDRSandblast-GodFault☆240Updated last year
- A tool for converting SysWhispers3 syscalls for use with Nim projects☆138Updated 2 years ago
- POC for frustrating/defeating Malware Analysts☆149Updated 2 years ago
- Patch AMSI and ETW☆230Updated 6 months ago
- Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low…☆128Updated last year
- Beacon Object File Loader☆273Updated 11 months ago
- different ntdll unhooking techniques : unhooking ntdll from disk, from KnownDlls, from suspended process, from remote server (fileless)☆175Updated last year
- A newer iteration of TitanLdr with some newer hooks, and design. A generic user defined reflective DLL I built to prove a point to Mudge …☆159Updated last year
- PE obfuscator with Evasion in mind☆210Updated last year
- GregsBestFriend process injection code created from the White Knight Labs Offensive Development course☆171Updated last year
- WTSRM☆199Updated 2 years ago
- The code is a pingback to the Dark Vortex blog: https://0xdarkvortex.dev/hiding-memory-allocations-from-mdatp-etwti-stack-tracing/☆158Updated last year
- This project is an implant framework designed for long term persistent access to Windows machines.☆110Updated last year
- A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, f…☆149Updated 5 months ago
- Weaponized HellsGate/SigFlip☆191Updated last year
- Tool for playing with Windows Access Token manipulation.☆51Updated last year
- ☆116Updated 2 months ago