SECFORCE / SharpWhispers
C# porting of SysWhispers2. It uses SharpASM to find the code caves for executing the system call stub.
☆101Updated last year
Related projects ⓘ
Alternatives and complementary repositories for SharpWhispers
- A collection of various and sundry code snippets that leverage .NET dynamic tradecraft☆135Updated 6 months ago
- Simple BOF to read the protection level of a process☆104Updated last year
- Source generator to add D/Invoke and indirect syscall methods to a C# project.☆170Updated 8 months ago
- ☆108Updated last year
- ☆133Updated last year
- Patch AMSI and ETW in remote process via direct syscall☆77Updated 2 years ago
- ☆142Updated last year
- A newer iteration of TitanLdr with some newer hooks, and design. A generic user defined reflective DLL I built to prove a point to Mudge …☆166Updated last year
- Stealthier variation of Module Stomping and Module Overloading injection techniques that reduces memory IoCs. Implemented in Python ctype…☆108Updated last year
- ☆122Updated 11 months ago
- Lateral Movement via the .NET Profiler☆76Updated this week
- Implant drop-in for EDR testing☆128Updated last year
- ☆175Updated 11 months ago
- ☆119Updated last year
- An App Domain Manager Injection DLL PoC on steroids☆161Updated 11 months ago
- Do some DLL SideLoading magic☆75Updated last year
- A basic meterpreter protocol stager using the libpeconv library by hasherezade for reflective loading☆83Updated 2 years ago
- Tool for playing with Windows Access Token manipulation.☆52Updated last year
- Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from mem…☆110Updated last year
- A C# tool to output crackable DPAPI hashes from user MasterKeys☆131Updated 2 months ago
- reflectively load and execute PEs locally and remotely bypassing EDR hooks☆148Updated 10 months ago
- Find .net assemblies locally☆92Updated 2 years ago
- Payload for DLL sideloading of the OneDriveUpdater.exe, based on the PaloAltoNetwork Unit42's blog post☆86Updated 2 years ago
- Find DLLs with RWX section☆75Updated last year
- A variation of ProcessOverwriting to execute shellcode on an executable's section☆145Updated 11 months ago
- A C# Solution Source Obfuscator for avoiding AV signatures with minimal user interaction. Powered by the Roslyn C# library.☆70Updated 4 years ago
- Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged☆86Updated 2 years ago
- ☆118Updated last year
- Porting of BOF InlineExecute-Assembly to load .NET assembly in process but with patchless AMSI and ETW bypass using hardware breakpoint.☆158Updated last year