A C++ proof of concept demonstrating the exploitation of Windows Protected Process Light (PPL) by leveraging COM-to-.NET redirection and reflection techniques for code injection. This PoC showcases bypassing code integrity checks and loading malicious payloads in highly protected processes such as LSASS. Based on research from James Forshaw.
☆336Mar 6, 2025Updated last year
Alternatives and similar repositories for ComDotNetExploit
Users that are interested in ComDotNetExploit are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely☆397Dec 13, 2024Updated last year
- ForsHops☆156Mar 25, 2025Updated last year
- A set of programs for analyzing common vulnerabilities in COM☆266Sep 8, 2024Updated 2 years ago
- BOF that finds all the Nt* system call stubs within NTDLL and overwrites with clean syscall stubs (user land hook evasion)☆217Feb 6, 2025Updated last year
- Bypass Credential Guard by patching WDigest.dll using only NTAPI functions☆270Apr 8, 2025Updated last year
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Sleep obfuscation☆275Dec 13, 2024Updated last year
- Activation Context Hijack☆183May 4, 2026Updated 5 months ago
- "Service-less" driver loading☆191Nov 28, 2024Updated last year
- Lab research on Windows loader internals, PE loading, stack artifacts, and execution tradeoffs.☆244May 4, 2026Updated 5 months ago
- Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) Phan…☆315Sep 18, 2024Updated 2 years ago
- Cobaltstrike Reflective Loader with Synthetic Stackframe☆193Jan 17, 2026Updated 9 months ago
- Proof of Concept (PoC) .NET tool for remotely killing EDR with WDAC☆441Sep 29, 2025Updated last year
- Reaping treasures from strings in remote processes memory☆286Feb 8, 2025Updated last year
- A BOF that runs unmanaged PEs inline☆703Oct 23, 2024Updated 2 years ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- Hijacks code execution via overwriting Control Flow Guard pointers in combase.dll☆155Apr 18, 2025Updated last year
- BOF with Synthetic Stackframe☆274Oct 30, 2025Updated 11 months ago
- .NET assembly loader with patchless AMSI and ETW bypass☆392Apr 19, 2023Updated 3 years ago
- ☆140Jan 16, 2025Updated last year
- A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.☆410Jan 11, 2026Updated 9 months ago
- A beacon object file implementation of PoolParty Process Injection Technique.☆461Dec 21, 2023Updated 2 years ago
- Mirage is a PoC memory evasion technique that relies on a vulnerable VBS enclave to hide shellcode within VTL1.☆115Feb 25, 2025Updated last year
- Process injection alternative☆404Sep 6, 2024Updated 2 years ago
- COM ViewLogger — new malware keylogging technique☆412Jan 6, 2025Updated last year
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- This is the loader that supports running a program with Protected Process Light (PPL) protection functionality.☆311May 23, 2026Updated 5 months ago
- Run native PE or .NET executables entirely in-memory. Build the loader as an .exe or .dll—DllMain is Cobalt Strike UDRL-compatible☆279Jun 18, 2025Updated last year
- Lateral Movement via Bitlocker DCOM interfaces & COM Hijacking☆468Jun 27, 2025Updated last year
- Safely manage the unloading of DLLs that have been hooked into a process. Context: https://github.com/KNSoft/KNSoft.SlimDetours/discussio…☆82Jun 21, 2025Updated last year
- TypeLib persistence technique☆151Oct 22, 2024Updated 2 years ago
- BOF and Python3 implementation of technique to unbind 445/tcp on Windows via SCM interactions☆363Nov 19, 2024Updated last year
- ☆135Feb 11, 2025Updated last year
- Code execution/injection technique using DLL PEB module structure manipulation☆293Jun 4, 2025Updated last year
- ☆126Sep 1, 2024Updated 2 years ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Stage 0☆170Dec 18, 2024Updated last year
- An example reference design for a proposed BOF PE☆251Jan 23, 2026Updated 9 months ago
- Windows rootkit designed to work with BYOVD exploits☆224Jan 18, 2025Updated last year
- SharpExShell automates the DCOM lateral movment technique which abuses ActivateMicrosoftApp method of Excel application.☆76May 1, 2024Updated 2 years ago
- ☆200Mar 28, 2025Updated last year
- Shellcode Loader Utilizing ETW Events☆66Feb 26, 2025Updated last year
- A PowerShell console in C/C++ with all the security features disabled☆399Oct 14, 2025Updated last year