Ridter / atexec-pro
Fileless atexec, no more need for port 445
☆325Updated 7 months ago
Related projects ⓘ
Alternatives and complementary repositories for atexec-pro
- Positional Independent Code to extract clear text password from mstsc.exe using API Hooking via HWBP.☆227Updated 4 months ago
- Credential Guard Bypass Via Patching Wdigest Memory☆309Updated last year
- ☆207Updated 6 months ago
- ☆229Updated 10 months ago
- A Tool that aims to evade av with binary padding☆135Updated 4 months ago
- A beacon object file implementation of PoolParty Process Injection Technique.☆321Updated 10 months ago
- BOF and Python3 implementation of technique to unbind 445/tcp on Windows via SCM interactions☆264Updated 3 months ago
- Escalate Service Account To LocalSystem via Kerberos☆389Updated last year
- Dynamically convert an unmanaged EXE or DLL file to PIC shellcode by prepending a shellcode stub.☆265Updated 6 months ago
- Weaponized CobaltStrike BOF for CVE-2023-36874 Windows Error Reporting LPE☆200Updated last year
- Attempt at Obfuscated version of SharpCollection☆188Updated last month
- BOF for Kerberos abuse (an implementation of some important features of the Rubeus).☆389Updated this week
- A list of python tools to help create an OPSEC-safe Cobalt Strike profile.☆370Updated 8 months ago
- ☆146Updated 3 months ago
- ☆311Updated 11 months ago
- Terminate AV/EDR Processes using kernel driver☆336Updated last year
- Bypassing UAC with SSPI Datagram Contexts☆409Updated last year
- Local privilege escalation from SeImpersonatePrivilege using EfsRpc.☆304Updated 2 years ago
- Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry☆275Updated 3 months ago
- Abuse Impersonate Privilege from Service to SYSTEM like other potatoes do☆365Updated last year
- A CobaltStrike toolkit to write files produced by Beacon to memory instead of disk☆426Updated 4 months ago
- A Windows potato to privesc☆340Updated 2 months ago
- Execute shellcode from a remote-hosted bin file using Winhttp.☆224Updated last year
- Cobalt Strike Beacon Object File (BOF) that uses WinStationConnect API to perform local/remote RDP session hijacking.☆297Updated 2 years ago
- Dump lsass using only NTAPIS running 3 programs to create 3 JSON and 1 ZIP file... and generate the Minidump later!☆350Updated last month
- Creating a repository with all public Beacon Object Files (BoFs)☆420Updated last year
- Use ESC1 to perform a makeshift DCSync and dump hashes☆198Updated last year
- Leak of any user's NetNTLM hash. Fixed in KB5040434☆239Updated 2 months ago