OccamsXor / sim-ba
(Sim)ulate (Ba)zar Loader
☆29Updated 4 years ago
Alternatives and similar repositories for sim-ba:
Users that are interested in sim-ba are comparing it to the libraries listed below
- Injects shellcode into remote processes using direct syscalls☆74Updated 4 years ago
- Recreating and reviewing the Windows persistence methods☆37Updated 3 years ago
- C++ implant that interfaces with a SK8PARK server☆48Updated 3 years ago
- Upsilon execute shellcode with syscalls - no API like NtProtectVirtualMemory is used☆92Updated 3 years ago
- ☆37Updated 3 years ago
- all credits go to @mgeeky☆59Updated 3 years ago
- A simple dumper as FreshyCalls' PoC. That's what's trendy, isn't it? ¯\_(ツ)_/¯☆40Updated 4 years ago
- ☆55Updated 3 years ago
- ☆16Updated 3 years ago
- A C implementation of the Sektor7 "A Thief" Windows privesc technique.☆61Updated 2 years ago
- GhostLoader - AppDomainManager - Injection - 攻壳机动队☆52Updated 4 years ago
- A small commented POC for removing API hooks placed by AV/EDR.☆33Updated 4 years ago
- A PoC~ish of https://elastic.github.io/security-research/malware/2022/01/01.operation-bleeding-bear/article/☆30Updated 11 months ago
- Loads .NET Assembly Via CLR Loader☆15Updated 5 years ago
- 64bit Windows 10 shellcode that adds user BOKU:SP3C1ALM0V3 to the system and the localgroups Administrators & "Remote Desktop Users"☆37Updated 3 years ago
- C# implementation of Shellcode delivery techniques using PInvoke and DInvoke variations for API calling.☆35Updated 3 years ago
- A simple COM server which provides a component to run shellcode☆133Updated 4 years ago
- RDPThief donut shellcode inject into mstsc☆83Updated 3 years ago
- Covenant is a collaborative .NET C2 framework for red teamers.☆22Updated 4 years ago
- A project to replicate the functionality of Noah Powers' ServerSetup script, but with error handling and fixed Namecheap API support.☆33Updated 3 years ago
- Create a Run registry key with direct system calls. Inspired by @Cneelis's Dumpert and SharpHide.☆74Updated 4 years ago
- ☆81Updated 3 years ago
- Bypass UAC elevation on Windows 8 (build 9600) & above.☆54Updated 2 years ago
- Hardened Proof of Concept of D/Invoke Process Injection malware☆40Updated 4 years ago
- A simple injector that uses LoadLibraryA☆17Updated 4 years ago
- File Write Weapon for Privilege Escalation To get SYSTEM☆17Updated 4 years ago
- Assembly HellGate implementation that directly calls Windows System Calls and displays the PPID of the explorer.exe process☆100Updated last year
- ☆14Updated 2 years ago
- A C port of b33f's UrbanBishop☆38Updated 4 years ago
- IOXIDResolver from AirBus Security/PingCastle☆46Updated 4 years ago