This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for local privilege escalation in the context of an unquoted service path, etc. The payload itself can be remotely hosted, downloaded via the wininet library and then executed via direct system calls.
☆55May 8, 2023Updated 3 years ago
Alternatives and similar repositories for DSC_SVC_REMOTE
Users that are interested in DSC_SVC_REMOTE are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- This POC provides the possibilty to execute x86 shellcode in form of a .bin file based on x86 inline assembly☆20Apr 17, 2023Updated 3 years ago
- A proof of concept of real custom GetProcAddress and GetModuleBaseAddress☆20Jul 9, 2022Updated 4 years ago
- Slides and POC demo for my talk at Divizion Zero on EDR evasion titled "Evasion Adventures"☆31Jan 14, 2023Updated 3 years ago
- ☆19Jul 23, 2023Updated 3 years ago
- Improved version of EKKO by @5pider that Encrypts only Image Sections☆124Feb 13, 2023Updated 3 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Use hardware breakpoints to spoof the call stack for both syscalls and API calls☆204Jun 6, 2024Updated 2 years ago
- Splitting and executing shellcode across multiple pages☆102Jun 8, 2023Updated 3 years ago
- A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (…☆178Feb 10, 2023Updated 3 years ago
- My personal shellcode loader☆32Mar 9, 2023Updated 3 years ago
- Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle…☆306Aug 2, 2023Updated 3 years ago
- Shellcode Loader with Indirect Dynamic syscall Implementation , shellcode in MAC format, API resolving from PEB, Syscall calll and syscal…☆322Aug 2, 2023Updated 3 years ago
- ☆48Feb 11, 2023Updated 3 years ago
- abusing Process Hacker driver to terminate other processes (BYOVD)☆83May 23, 2023Updated 3 years ago
- A method to execute shellcode using RegisterWaitForInputIdle API.☆53Apr 4, 2023Updated 3 years ago
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- Simple Kernel Mode Driver for Swapping Process Token☆130Sep 19, 2026Updated last month
- NimSkrull is an adaption from the original Skrull malware anti-copy DRM. Only for the anti-copy feature. (https://github.com/aaaddress1/S…☆13May 20, 2023Updated 3 years ago
- Execute a payload at each right click on a file/folder in the explorer menu for persistence☆172Mar 15, 2023Updated 3 years ago
- Exploring in-memory execution of .NET☆138Apr 20, 2022Updated 4 years ago
- An attempt at reversing WindowsDefender☆19Oct 6, 2024Updated 2 years ago
- Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low…☆146May 6, 2023Updated 3 years ago
- ☆15Nov 23, 2021Updated 4 years ago
- This novel way of using NtQueueApcThreadEx by abusing the ApcRoutine and SystemArgument[0-3] parameters by passing a random pop r32; ret …☆266Apr 29, 2023Updated 3 years ago
- Small PoC of using a Microsoft signed executable as a lolbin.☆137Feb 27, 2023Updated 3 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Exploring different process injection techniques based on malware analysis☆14Dec 28, 2023Updated 2 years ago
- Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged☆87Jul 7, 2022Updated 4 years ago
- Block any Process to open HANDLE to your process , only SYTEM is allowed to open handle to your process ,with that you can avoid remote m…☆172Apr 27, 2023Updated 3 years ago
- ☆58Jun 26, 2022Updated 4 years ago
- Replace the .txt section of the current loaded modules from \KnownDlls\☆308Sep 28, 2022Updated 4 years ago
- A simple PoC to invoke an encrypted shellcode by using an hidden call☆115Nov 19, 2022Updated 3 years ago
- Find DLLs with RWX section☆81Jul 3, 2023Updated 3 years ago
- Shellcode Loader Implementing Indirect Dynamic Syscall , API Hashing, Fileless Shellcode retrieving using Winsock2☆298Jul 15, 2023Updated 3 years ago
- Hiding shellcode in plain sight within a large memory region. Inspired by technique used by Raspberry Robin's Roshtyak☆209Nov 12, 2025Updated 11 months ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- Dynamic and extensible shell code generator with multiple output types which can be formatted in binary, hexadecimal, and the typical she…☆18May 1, 2020Updated 6 years ago
- all random stuff that dont warrant a seperate repo☆12Sep 2, 2022Updated 4 years ago
- Malware dev tricks: parent PID spoofing. C++ implementation☆12Sep 7, 2022Updated 4 years ago
- Terminate AV/EDR Processes using kernel driver☆354Jun 12, 2023Updated 3 years ago
- Execute shellcode from a remote-hosted bin file using Winhttp.☆235Jun 22, 2023Updated 3 years ago
- Set the process mitigation policy for loading only Microsoft Modules , and block any userland 3rd party modules☆41May 6, 2023Updated 3 years ago
- ☆507Aug 14, 2022Updated 4 years ago