Alternatives and similar repositories for Pentest-Windows:

Users that are interested in Pentest-Windows are comparing it to the libraries listed below

• ariary / DogWalk-rce-poc
  🐾Dogwalk PoC (using diagcab file to obtain RCE on windows)
  ☆80Updated 2 years ago
• waawaa / AMSI_Rubeus_bypass
  ☆61Updated 2 years ago
• RedSiege / What-The-F
  This repo hosts a poc of how to execute F# code within an unmanaged process
  ☆66Updated 6 months ago
• Wh04m1001 / RazerEoP
  ☆25Updated 2 years ago
• VirtualAlllocEx / Taskschedule-Persistence-Download-Cradles
  Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged
  ☆86Updated 2 years ago
• ChoiSG / OneDriveUpdaterSideloading
  Payload for DLL sideloading of the OneDriveUpdater.exe, based on the PaloAltoNetwork Unit42's blog post
  ☆88Updated 2 years ago
• N4kedTurtle / LocalDllParse
  ☆54Updated 3 years ago
• reveng007 / AMSI-patches-learned-till-now
  I have documented all of the AMSI patches that I learned till now
  ☆68Updated last year
• hackerhouse-opensource / MsSettingsDelegateExecute
  Bypass UAC on Windows 10/11 x64 using ms-settings DelegateExecute registry key.
  ☆78Updated 2 years ago
• Wh04m1001 / DiagTrackEoP
  ☆89Updated 2 years ago
• pwnsauc3 / RWXfinder
  The program uses the Windows API functions to traverse through directories and locate DLL files with RWX section
  ☆98Updated last year
• FuzzySecurity / WWHF-WayWest-2022
  ☆38Updated 2 years ago
• tothi / SharpStay
  .NET project for installing Persistence
  ☆64Updated 2 years ago
• 0x00Check / ExploitLeakedHandle
  Identify and exploit leaked handles for local privilege escalation.
  ☆106Updated last year
• dis0rder0x00 / CanYouCTheThief
  A C implementation of the Sektor7 "A Thief" Windows privesc technique.
  ☆61Updated 2 years ago
• plackyhacker / Peruns-Fart
  Perun's Fart (Slavic God's Luck). Another method for unhooking AV and EDR, this is my C# version.
  ☆105Updated 3 years ago
• boku7 / halosgate-ps
  Cobalt Strike BOF that uses a custom ASM HalosGate & HellsGate syscaller to return a list of processes
  ☆98Updated last year
• inb1ts / birdnet-poc
  Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.
  ☆39Updated last year
• antonioCoco / infosec-talks
  ☆49Updated last year
• shogunlab / Mochi
  Mochi is a proof-of-concept C++ loader that leverages the ChaiScript embedded scripting language to execute code.
  ☆99Updated 2 years ago
• x0rb3l / CVE-2023-36802-MSKSSRV-LPE
  PoC for CVE-2023-36802 Microsoft Kernel Streaming Service Proxy
  ☆35Updated last year
• shantanu561993 / DLL-Sideload
  ☆39Updated 2 years ago
• crisprss / magicNetdefs
  Similar to Petitpotam, the netdfs service is enabled in Windows Server and AD environments, and the abused RPC method allows privileged p…
  ☆49Updated 2 years ago
• 0xsp-SRD / callback_injection-Csharp
  this repo is to cover the other undocumented or published / in different langaue to achieve shellcode injection via windows callback func…
  ☆84Updated 2 years ago
• ScriptIdiot / SysmonQuiet
  RDLL for Cobalt Strike beacon to silence sysmon process
  ☆87Updated 2 years ago
• joe-desimone / rep-research
  ☆68Updated 5 months ago
• Wh04m1001 / Random
  Random
  ☆32Updated 2 years ago