ZephrFish / HelloJackHunter
Research into WinSxS binaries and finding hijackable paths
☆26Updated 8 months ago
Alternatives and similar repositories for HelloJackHunter:
Users that are interested in HelloJackHunter are comparing it to the libraries listed below
- ☆48Updated 3 months ago
- Tool to aid in dumping LSASS process remotely☆38Updated 6 months ago
- ☆28Updated 7 months ago
- GPOAnalyzer is a tool designed to assist in parsing domain Group Policy Object (GPO) files located in the SYSVOL directory.☆23Updated 7 months ago
- ☆92Updated 11 months ago
- ☆50Updated last month
- DFSCoerce exe revisited version with custom authentication☆38Updated last year
- Tool to bypass LSA Protection (aka Protected Process Light)☆44Updated 3 weeks ago
- ☆92Updated 4 months ago
- SharpExShell automates the DCOM lateral movment technique which abuses ActivateMicrosoftApp method of Excel application.☆68Updated 8 months ago
- Tool designed to simplify the generation of proxy DLLs while addressing common conflicts related to windows.h☆35Updated 3 months ago
- DLL proxy load example using the Windows thread pool API, I/O completion callback with named pipes, and C++/assembly☆60Updated 10 months ago
- This repo goes with the blog entry at blog.malicious.group entitled "Writing your own RDI / sRDI loader using C and ASM".☆75Updated last year
- "D3MPSEC" is a memory dumping tool designed to extract memory dump from Lsass process using various techniques, including direct system c…☆24Updated 4 months ago
- Bypassing Amsi using LdrLoadDll☆32Updated 3 weeks ago
- Source code and examples for PassiveAggression☆54Updated 7 months ago
- Section-based payload obfuscation technique for x64☆59Updated 5 months ago
- Mythic C2 Agent written in x64 PIC C☆65Updated this week
- SAM Dumping in C#☆40Updated 2 weeks ago
- Construct the payload at runtime using an array of offsets☆61Updated 7 months ago
- early cascade injection PoC based on Outflanks blog post, in rust☆50Updated 2 months ago
- a simple poc showcasing the ability of an admin to suspend EDR's protected processes , making it useless☆39Updated 6 months ago
- ☆47Updated last year
- A tool to modify SCCM remote control settings on the client machine, enabling remote control without permission prompts or notifications.…☆77Updated 3 months ago
- Just another ntdll unhooking using Parun's Fart technique☆73Updated last year
- malleable profile generator GUI for Havoc☆56Updated last year
- ☆73Updated last year
- BOF for C2 framework☆39Updated 2 months ago
- lsassdump via RtlCreateProcessReflection and NanoDump☆77Updated 3 months ago
- Bunch of BOF files☆27Updated last month