SECFORCE / SharpWhispers
C# porting of SysWhispers2. It uses SharpASM to find the code caves for executing the system call stub.
☆104Updated last year
Alternatives and similar repositories for SharpWhispers:
Users that are interested in SharpWhispers are comparing it to the libraries listed below
- A collection of various and sundry code snippets that leverage .NET dynamic tradecraft☆137Updated 8 months ago
- Payload for DLL sideloading of the OneDriveUpdater.exe, based on the PaloAltoNetwork Unit42's blog post☆88Updated 2 years ago
- Implant drop-in for EDR testing☆131Updated last year
- Source generator to add D/Invoke and indirect syscall methods to a C# project.☆173Updated 10 months ago
- Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from mem…☆111Updated last year
- An App Domain Manager Injection DLL PoC on steroids☆164Updated last year
- A newer iteration of TitanLdr with some newer hooks, and design. A generic user defined reflective DLL I built to prove a point to Mudge …☆172Updated last year
- ☆126Updated last year
- Simple BOF to read the protection level of a process☆114Updated last year
- ☆111Updated last year
- ☆120Updated last year
- Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF) via Syswhispers2☆179Updated 2 years ago
- Section Mapping Process Injection (secinject): Cobalt Strike BOF☆90Updated 3 years ago
- Do some DLL SideLoading magic☆76Updated last year
- Patch AMSI and ETW☆234Updated 8 months ago
- A C# Solution Source Obfuscator for avoiding AV signatures with minimal user interaction. Powered by the Roslyn C# library.☆71Updated 4 years ago
- An example of using Syscalls in C# to get a meterpreter shell.☆108Updated 3 years ago
- Dynamically invoke arbitrary unmanaged code from managed code without P/Invoke.☆149Updated 11 months ago
- Cobalt Strike BOF that uses a custom ASM HalosGate & HellsGate syscaller to return a list of processes☆98Updated last year
- reflectively load and execute PEs locally and remotely bypassing EDR hooks☆149Updated last year
- Tool for playing with Windows Access Token manipulation.☆53Updated 2 years ago
- Find .net assemblies locally☆103Updated 2 years ago
- ☆180Updated last year
- Patch AMSI and ETW in remote process via direct syscall☆80Updated 2 years ago
- A tool for converting SysWhispers3 syscalls for use with Nim projects☆141Updated 2 years ago
- Lateral Movement via the .NET Profiler☆75Updated last month
- A variation of ProcessOverwriting to execute shellcode on an executable's section☆147Updated last year
- Stealthier variation of Module Stomping and Module Overloading injection techniques that reduces memory IoCs. Implemented in Python ctype…☆109Updated last year
- ☆146Updated last year