itaymigdal / GhostNap
Sleep obfuscation for shellcode implants and their reflective shit
☆52Updated last year
Related projects ⓘ
Alternatives and complementary repositories for GhostNap
- malware written for educational purposes☆59Updated last week
- PoC XLL builder in Python/Nim☆40Updated 2 years ago
- ShellcodeFluctuation PoC ported to Nim☆75Updated 2 years ago
- Writing Nimless Nim - Slides and source for BSIDESKC 2024 talk.☆64Updated 5 months ago
- NimReflectiveLoader is a Nim-based tool for in-memory DLL execution using Reflective DLL Loading.☆26Updated 10 months ago
- NimicStack is the pure Nim implementation of Call Stack Spoofing technique to mimic legitimate programs☆91Updated 2 years ago
- ☆47Updated last year
- A quick example of the Hells Gate technique in Nim☆92Updated 3 years ago
- COFF and BOF Loader written in Nim☆168Updated 2 years ago
- Indirect syscalls + DInvoke made simple.☆85Updated 3 weeks ago
- D/Invoke implementation in Nim☆99Updated 2 years ago
- Grab unsaved Notepad contents with a Beacon Object File☆48Updated 2 years ago
- ☆41Updated last year
- a simple poc showcasing the ability of an admin to suspend EDR's protected processes , making it useless☆39Updated 4 months ago
- ☆39Updated last year
- Simple EDR that injects a DLL into a process to place a hook on specific Windows API☆88Updated last year
- Tool for playing with Windows Access Token manipulation.☆52Updated last year
- Proof of Concept code and samples presenting emerging threat of MSI installer files.☆77Updated last year
- Nim process hollowing loader☆47Updated 3 months ago
- Nim version of MDSec's Parallel Syscall PoC☆123Updated 2 years ago
- Your syscall factory☆121Updated 2 months ago
- Threadless shellcode injection tool☆60Updated 3 months ago
- A tool for converting SysWhispers2 syscalls for use with Nim projects☆117Updated 2 years ago
- Sample Rust Hooking Engine☆34Updated 7 months ago
- Click Once + App Domain☆62Updated 11 months ago
- A care package of useful bofs for red team engagments☆48Updated 2 years ago
- Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged☆86Updated 2 years ago
- Python module for running BOFs☆64Updated last year
- Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.☆38Updated last year
- DLL proxy load example using the Windows thread pool API, I/O completion callback with named pipes, and C++/assembly☆57Updated 8 months ago