One WSL BOF to rule them all
☆159Jan 14, 2026Updated last month
Alternatives and similar repositories for the-one-wsl-bof
Users that are interested in the-one-wsl-bof are comparing it to the libraries listed below
Sorting:
- ☆171Oct 21, 2025Updated 4 months ago
- A BOF that's a BOF Loader and more☆199Jan 17, 2026Updated last month
- RawCopy - Golang implementation☆24Oct 27, 2022Updated 3 years ago
- Manage Shadows Copies via the VSS API using C#, C++, Crystal or Python. Working on Windows 11☆84Jan 26, 2026Updated last month
- List web account manager (WAM) accounts added to the current profile☆22Dec 11, 2025Updated 2 months ago
- Beacon Debugger☆55Oct 28, 2024Updated last year
- Proof of concept for Kerberos Armoring abuse.☆81Dec 12, 2025Updated 2 months ago
- Updated version of a long known self deletion technique to work with 24H2.☆61Jun 9, 2025Updated 9 months ago
- Shellcode capable of bypassing EAF / IAF mitigations☆28Apr 11, 2023Updated 2 years ago
- Minimal Windows Service Template for demonstrating privilege escalation via weak service executable permissions☆14Nov 13, 2022Updated 3 years ago
- Reflective shellcode loaderwith advanced call stack spoofing and .NET support.☆227Sep 19, 2025Updated 5 months ago
- Reaping treasures from strings in remote processes memory☆284Feb 8, 2025Updated last year
- Implant drop-in for EDR testing☆147Nov 15, 2023Updated 2 years ago
- A hoontr must hoont☆106Nov 27, 2025Updated 3 months ago
- Creating a repository with all public Beacon Object Files (BoFs)☆577Aug 30, 2023Updated 2 years ago
- ForsHops☆152Mar 25, 2025Updated 11 months ago
- ☆19Sep 1, 2025Updated 6 months ago
- NSecSoftBYOVD POC☆58Feb 12, 2026Updated 3 weeks ago
- Cobalt Strike BOF for beacon/shellcode injection using fork & run technique with Draugr synthetic stack frames☆152Nov 23, 2025Updated 3 months ago
- Windows User-Mode Shellcode Development Framework (WUMSDF)☆126Nov 17, 2025Updated 3 months ago
- Moonwalk++: Simple POC Combining StackMoonwalking and Memory Encryption☆204Dec 17, 2025Updated 2 months ago
- UDC2 implementation that provides an ICMP C2 channel☆115Nov 24, 2025Updated 3 months ago
- ☆126Sep 1, 2024Updated last year
- Implementing Ghostly-Hollowing using tampered syscalls for remote PE injection☆71Dec 26, 2025Updated 2 months ago
- ☆59Feb 19, 2026Updated 2 weeks ago
- PowerShell tool that shows how to read and write NTLM OWF values via samlib.dll.☆72Oct 22, 2025Updated 4 months ago
- A Beacon Object File (BOF) that performs the complete ESC1 attack chain in a single execution: certificate request with arbitrary SAN (+S…☆116Dec 21, 2025Updated 2 months ago
- Linker for Beacon Object Files☆159Feb 22, 2026Updated 2 weeks ago
- A Beacon Object File (BOF) that talks directly to Windows authentication packages through the LSA untrusted/trusted client interface, wit…☆265Feb 21, 2026Updated 2 weeks ago
- template for developing custom C2 channels for Cobalt Strike using IAT hooks applied by a reflective loader.☆101Jan 10, 2026Updated last month
- Collection of BOFs created for red team/adversary engagements. Created to be small and interchangeable, for quick recon or eventing.☆240Feb 20, 2026Updated 2 weeks ago
- A simple Sleepmask BOF example☆169Nov 24, 2025Updated 3 months ago
- DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely☆382Dec 13, 2024Updated last year
- An ICMP channel for Beacons, implemented using Cobalt Strike’s External C2 framework.☆116Oct 6, 2025Updated 5 months ago
- Self-cleaning in-memory PICO loader for Crystal Palace. Automatically erases traces and operates entirely in memory for stealthy payload …☆49Nov 2, 2025Updated 4 months ago
- Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) Phan…☆283Sep 18, 2024Updated last year
- BOF and Python3 implementation of technique to unbind 445/tcp on Windows via SCM interactions☆345Nov 19, 2024Updated last year
- A portable C# utility for enumerating local and remote windows sessions☆56Jan 1, 2026Updated 2 months ago
- Using call gadgets to break the call stack signature used by Elastic on proxying a module load. Provided as a Crystal Palace shared libra…☆80Nov 6, 2025Updated 4 months ago