LPE Proof-of-Concept for Windows 11 abusing TrustedInstaller's Component Based Servicing (CBS) session COM object and junctions for arbitrary file write.
☆55Nov 1, 2026Updated this week
Alternatives and similar repositories for TrustedHive
Users that are interested in TrustedHive are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A PoC tool for the Pass-ta-key Golden Attack, covering the extraction of the Google Password Manager Security Domain Secret (SDS) from Ch…☆27Updated this week
- ☆44Oct 27, 2026Updated last week
- ☆37May 19, 2026Updated 5 months ago
- Demonstration of the DLL party process injection technique☆98Oct 1, 2026Updated last month
- Runtime Credential Guard deactivation via \\LSA_ISO_DISABLE_CREDENTIAL_GUARD + LSASS NT hash extraction (Win11 24H2)☆103Oct 27, 2026Updated last week
- Open source password manager - Proton Pass • AdSecurely store, share, and autofill your credentials with Proton Pass, the end-to-end encrypted password manager trusted by millions.
- A stealthy process injection PoC combining Thread Name-Calling for payload delivery with Waiting Thread Hijacking for execution, with zer…☆139Updated this week
- Contains materials for my technical presentation exploring Linux malware tradecraft—from userland and fileless techniques to kernel rootk…☆106Updated this week
- A PoC of User-Defined Reflective Loader for Havoc Framework built with Cystal Palace☆48Oct 18, 2026Updated 2 weeks ago
- BOF and research notes from hunting execution paths, covering Shell.HWEventHandlerShellExecute COM execution through the AutoPlay IHWEven…☆39Jun 20, 2026Updated 4 months ago
- EDR evasion uses stealth injection via SendMessage with WM_SETTEXT to effective bypass EDR (Endpoint Detection and Response)☆75Oct 18, 2026Updated 2 weeks ago
- Clean Indirect Syscalls with Syscall Tampering.☆51Oct 25, 2026Updated last week
- Proof of concept exploit for CVE-2026-3775/CVE-2026-3780 and CVE-2026-57239 which lets you obtain NT AUTHORITY\SYSTEM rights via the Foxi…☆17Jul 27, 2026Updated 3 months ago
- ☆25Oct 27, 2026Updated last week
- Collection of custom implementations or Userland Primitives about some WinAPI functions☆47Oct 5, 2026Updated 3 weeks ago
- End-to-end encrypted cloud storage - Proton Drive • AdSpecial offer: 40% Off Yearly / 80% Off First Month. Protect your most important files, photos, and documents from prying eyes.
- A minimized non-intrusive version of EDR Introspection☆46Jun 30, 2026Updated 4 months ago
- ☆31Jul 24, 2026Updated 3 months ago
- A foundational C library for building operationally credible offensive capabilities☆95Sep 21, 2026Updated last month
- Windows x64 API hashing library that bypasses EAF and resolves forwarded exports, ordinals, and api-ms-*/ext-ms-* API Set DLLs.☆70Oct 7, 2026Updated 3 weeks ago
- This is a project aimed to make every other Saas product a C2, confluence is just the beginning.☆23Oct 21, 2026Updated 2 weeks ago
- Local Windows credential extraction☆26Jul 14, 2026Updated 3 months ago
- Using Just In Time (JIT) instruction decryption, this shellcode loader ensures that only the currently executing instruction is visible i…☆69Apr 2, 2025Updated last year
- Reflective DLL loader.☆27Jun 30, 2026Updated 4 months ago
- Remote process injection via TP_DIRECT.Callback hijack☆39Updated this week
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Kassandra is a custom Mythic C2 agent written in Rust, containerized via a Python-based builder☆25Jul 31, 2026Updated 3 months ago
- ANIMO Azure Network Intel & Mission Ops a C2 based on Azure/Entra assessments☆95Sep 16, 2026Updated last month
- A PoC Cobalt Strike UDRL written in Rust☆35Sep 12, 2026Updated last month
- ☆18Oct 3, 2026Updated last month
- Gain shellcode execution via T4 Text Transform files/TextTransoform.exe☆86Oct 23, 2026Updated last week
- A Beacon Object File (BOF) for Cobalt Strike and Mythic C2 that implements COM hijacking for persistence on Windows systems.☆37Feb 17, 2026Updated 8 months ago
- Linux kernel FUSE readdir cache out-of-bounds write (CVE-2026-31694): a malicious FUSE server overflows a page-cache page by 24 bytes. Po…☆18Sep 14, 2026Updated last month
- Pull-based C2 framework with ten native transports, concurrent multi-profile handlers, and end-to-end ECDSA-signed tasking. Single Go bin…☆34Updated this week
- Proof of Concept for Process Code Injection Without Using WriteProcessMemory☆160Sep 27, 2026Updated last month
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- macOS Container Payload Wrapper☆23Mar 13, 2026Updated 7 months ago
- Mythic Code Signing Wrapper☆18Oct 27, 2026Updated last week
- LLM-driven generator for Mythic Agents, Payload-Type and C2 Profiles.☆55Aug 24, 2026Updated 2 months ago
- Enumerate user accounts and registered authentication methods via the Microsoft Self-Service Password Reset (SSPR) portal☆59Sep 15, 2026Updated last month
- A poor man's attempt to replicate the shellcode execution technique demo'd by @3lk during STHACK 2026 (https://www.youtube.com/watch?v=al…☆40Oct 14, 2026Updated 3 weeks ago
- Audiodg.exe DLL hijacking for LPE with reboot-free restart primitive. Executes code as LOCAL SERVICE, escalates to SYSTEM via Scheduled T…☆129Jan 24, 2026Updated 9 months ago
- Process Impairment Exploit Chain.☆36Aug 12, 2026Updated 2 months ago