forrest-orr / ExploitDev
Various tools, PoCs and experiments related to my blog at https://www.forrest-orr.net/
☆35Updated 3 years ago
Related projects: ⓘ
- Piece of code to detect and remove hooks in IAT☆51Updated 2 years ago
- ☆36Updated 3 years ago
- A C implementation of the Sektor7 "A Thief" Windows privesc technique.☆59Updated 2 years ago
- ☆31Updated this week
- A proof of concept I developed to improve Gargoyle back in 2018 to achieve true memory obfuscation from position independent code☆33Updated this week
- Assembly HellGate implementation that directly calls Windows System Calls and displays the PPID of the explorer.exe process☆97Updated last year
- A simple COM server which provides a component to run shellcode☆131Updated 4 years ago
- A simple dumper as FreshyCalls' PoC. That's what's trendy, isn't it? ¯\_(ツ)_/¯☆39Updated 3 years ago
- A small commented POC for removing API hooks placed by AV/EDR.☆33Updated 4 years ago
- Recreating and reviewing the Windows persistence methods☆39Updated 2 years ago
- ☆74Updated 3 weeks ago
- ☆87Updated this week
- ☆53Updated 2 years ago
- ☆50Updated this week
- Injects shellcode into remote processes using direct syscalls☆74Updated 3 years ago
- "An Introduction to Windows Exploit Development" is an open sourced, free Windows exploit development course I created for the Southeast …☆39Updated 4 years ago
- ☆25Updated this week
- ☆14Updated 2 years ago
- Upsilon execute shellcode with syscalls - no API like NtProtectVirtualMemory is used☆92Updated 3 years ago
- A C port of b33f's UrbanBishop☆35Updated 3 years ago
- Enabled / Disable LSA Protection via BYOVD☆61Updated 2 years ago
- all credits go to @mgeeky☆58Updated 2 years ago
- Small tool to play with IOCs caused by Imageload events☆37Updated last year
- API Hammering with C++20☆34Updated 2 years ago
- Overwrite a process's recovery callback and execute with WER☆100Updated 2 years ago
- Bypass UAC elevation on Windows 8 (build 9600) & above.☆53Updated 2 years ago
- A simple PE loader.☆25Updated last year
- ☆52Updated this week
- An insecurely implemented and installed Windows service for emulating elevation of privileges vulnerabilities☆43Updated 2 years ago
- Resolve syscall numbers at runtime for all Windows versions.☆59Updated 3 years ago