DLL Hijacking and Mock directories technique to bypass Windows UAC security feature and getting high-level privileged reverse shell. Security researchers identified this technique which uses a simplified process of DLL hijacking and mock folders to bypass UAC control. I tested this on Windows 10,11 and bypassed Windows 10 UAC security feature.
☆43May 18, 2024Updated last year
Alternatives and similar repositories for C2_Elevated_Shell_DLL_Hijcking
Users that are interested in C2_Elevated_Shell_DLL_Hijcking are comparing it to the libraries listed below
Sorting:
- Direct syscalls Injection to bypass AV/EDR☆12May 18, 2024Updated last year
- .NET profiler DLL loading can be abused to make a legit .NET application load a malicious DLL using environment variables. This exploit i…☆46Jul 29, 2024Updated last year
- PhantomsGate: Advanced Shellcode Injection Technique☆26Jul 15, 2024Updated last year
- This exploit is utilising AddressOfEntryPoint of process which is RX and using WriteProcessMemory internal magic to change the permission…☆18Oct 31, 2024Updated last year
- ☆109Feb 17, 2025Updated last year
- Obfuscate payloads using IPv4, IPv6, MAC or UUID strings☆23Feb 17, 2024Updated 2 years ago
- This is the combination of multiple evasion techniques to evade defenses. (Dirty Vanity)☆51May 8, 2024Updated last year
- A rework of CMLuaUtil AutoElevated☆30Nov 6, 2022Updated 3 years ago
- Dll injection through code page id modification in registry. Based on jonas lykk research☆17Jun 18, 2022Updated 3 years ago
- Random BOFs for LDAP tradecraft☆74Sep 9, 2025Updated 5 months ago
- A technique of hiding malicious shellcode via Shannon encoding.☆263Oct 23, 2022Updated 3 years ago
- 64bit WIndows 10 shellcode dat pops dat calc - Dynamic & Null Free☆65Mar 8, 2023Updated 2 years ago
- 🗡️ A multi-user malleable C2 framework targeting Windows. Written in C++ and Python☆45Feb 6, 2026Updated 3 weeks ago
- Projected developed for fun only that simulates APT 29 and Lockbit TTPs, showcasing phishing, ISO execution, and DLL proxying for persist…☆61May 3, 2024Updated last year
- Local & remote Windows DLL Proxying☆169Jun 17, 2024Updated last year
- shell code example☆68Dec 12, 2025Updated 2 months ago
- Implementation of Advanced Module Stomping and Heap/Stack Encryption☆225Jul 25, 2023Updated 2 years ago
- Winsocket for Cobalt Strike.☆102Jul 6, 2023Updated 2 years ago
- Modified versions of the Cobalt Strike Process Injection Kit☆106Jan 24, 2024Updated 2 years ago
- Cobalt Strike Beacon Object File (BOF) that obtain SYSTEM privilege with SeImpersonate privilege by passing a malicious IUnknwon object t…☆96Mar 20, 2023Updated 2 years ago
- AIDA64DRIVER Elevation of Privilege Vulnerability☆16Oct 25, 2024Updated last year
- [PHP][Python] Root Exploiter – No Back-Connect☆10Aug 27, 2021Updated 4 years ago
- All my POC related to malware development☆15Feb 19, 2026Updated last week
- Cobalt Strike notifications via NTFY.☆15Sep 24, 2024Updated last year
- Bypassing AV, EDR, Application Whitelisting and ASR Rules☆13Apr 18, 2023Updated 2 years ago
- This repository will contain source codes from the Tradecraft improvement blog series☆14Mar 27, 2025Updated 11 months ago
- Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.☆289May 27, 2024Updated last year
- Reflective DLL Injection Made Bella☆249Jan 6, 2025Updated last year
- P/Invoke definitions from the most-of-the-time offline offline pinvoke.net. Website: https://ricardojoserf.gitbook.io/pinvoke☆23Mar 23, 2025Updated 11 months ago
- Proof of Concept for manipulating the Kernel Callback Table in the Process Environment Block (PEB) to perform process injection and hijac…☆272Oct 31, 2024Updated last year
- C# Implementation of Jared Atkinson's Get-InjectedThread.ps1☆54Jul 11, 2021Updated 4 years ago
- Documents Exfiltration project for fun and educational purposes☆144Oct 10, 2023Updated 2 years ago
- Get-PDInvokeImports is tool (PowerShell module) which is able to perform automatic detection of P/Invoke, Dynamic P/Invoke and D/Invoke u…☆54Apr 10, 2022Updated 3 years ago
- A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.☆409Jan 11, 2026Updated last month
- Token Elevation to authorized user as SYSTEM or Domain Admins☆25Nov 22, 2025Updated 3 months ago
- Using LNK files and user input simulation to start processes under explorer.exe☆34Sep 21, 2024Updated last year
- abusing Process Hacker driver to terminate other processes (BYOVD)☆82May 23, 2023Updated 2 years ago
- Automated Multi UAC BYPASS for win10|win11|win12-pre-release|ws2019|ws2022☆455Feb 19, 2026Updated last week
- IOCTL-Flooder is a verbose tool designed to help with Windows driver fuzzing by brute forcing IOCTLs on loaded drivers. GetLastError is u…☆11Aug 21, 2018Updated 7 years ago