Shellcode loader using direct syscalls via Hell's Gate and payload encryption.
☆102Jun 16, 2024Updated last year
Alternatives and similar repositories for BenevolentLoader
Users that are interested in BenevolentLoader are comparing it to the libraries listed below
Sorting:
- WindowSpy is a Cobalt Strike Beacon Object File meant for automated and targeted user surveillance.☆281Feb 24, 2025Updated last year
- Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) Phan…☆283Sep 18, 2024Updated last year
- Excel Add In Payload Generator☆14Oct 9, 2023Updated 2 years ago
- Hooked create process injection for meterpreter☆23Jun 16, 2021Updated 4 years ago
- AV bypass while you sip your Chai!☆224May 17, 2024Updated last year
- An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution☆195Nov 27, 2024Updated last year
- Open Source C&C Specification☆277Feb 28, 2025Updated last year
- A technique that can be used to bypass AV/EDR memory scanners. This can be used to hide well-known and detected shellcodes (such as msfve…☆592Jun 12, 2024Updated last year
- Position-independent Reflective Loader for macOS☆118Feb 19, 2026Updated 2 weeks ago
- In-memory sleep encryption and heap encryption for Go applications through a shellcode function.☆40Jan 14, 2024Updated 2 years ago
- Hide shellcode by shuffling bytes into a random array and reconstruct at runtime☆203Mar 26, 2025Updated 11 months ago
- BOF that finds all the Nt* system call stubs within NTDLL and overwrites with clean syscall stubs (user land hook evasion)☆195Feb 6, 2025Updated last year
- Sleep obfuscation☆268Dec 13, 2024Updated last year
- Evasive shellcode loader☆401Oct 17, 2024Updated last year
- COM ViewLogger — new malware keylogging technique☆405Jan 6, 2025Updated last year
- PoC demonstrating a multi process injection chain aimed at remotely executing shellcode☆259Jan 21, 2024Updated 2 years ago
- For when DLLMain is the only way☆424Oct 29, 2024Updated last year
- BOF with Synthetic Stackframe☆230Oct 30, 2025Updated 4 months ago
- Admin to Kernel code execution using the KSecDD driver☆265Apr 19, 2024Updated last year
- This repo contains : simple shellcode Loader , Encoders (base64 - custom - UUID - IPv4 - MAC), Encryptors (AES), Fileless Loader (Winhttp…☆438Aug 2, 2023Updated 2 years ago
- Yet another C++ Cobalt Strike beacon dropper with Compile-Time API hashing and custom indirect syscalls execution☆200May 29, 2025Updated 9 months ago
- Abusing Azure services over C2☆367Jan 20, 2026Updated last month
- Tools for analyzing EDR agents☆277Jun 10, 2024Updated last year
- Various resources to enhance Cobalt Strike's functionality and its ability to evade antivirus/EDR detection☆323May 17, 2024Updated last year
- CSharp reimplementation of Venoma, another C++ Cobalt Strike beacon dropper with custom indirect syscalls execution☆51Apr 22, 2024Updated last year
- A collection of sample code used in some experiments with Sliver C2☆16Mar 28, 2023Updated 2 years ago
- early cascade injection PoC based on Outflanks blog post, in rust☆62Nov 8, 2024Updated last year
- Collection of Beacon Object Files (BOF) for Cobalt Strike☆675Aug 15, 2025Updated 6 months ago
- Shellcode Loader Implementing Indirect Dynamic Syscall , API Hashing, Fileless Shellcode retrieving using Winsock2☆293Jul 15, 2023Updated 2 years ago
- A simple website to act as a store for havoc modules and extensions☆28Jan 20, 2025Updated last year
- Bypassing UAC with SSPI Datagram Contexts☆462Sep 24, 2023Updated 2 years ago
- FaceDancer is an exploitation tool aimed at creating hijackable, proxy-based DLLs by taking advantage of COM-based system DLL image loadi…☆403Sep 26, 2024Updated last year
- PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS.☆569Jan 20, 2026Updated last month
- Find jmp gadgets for call stack spoofing.☆75Oct 1, 2025Updated 5 months ago
- A C# port from Invoke-GhostTask☆120Jan 5, 2024Updated 2 years ago
- Attempting to Hook LSASS APIs to Retrieve Plaintext Credentials☆61May 12, 2025Updated 9 months ago
- Slides & Code snippets for a workshop held @ x33fcon 2024☆283Jun 15, 2024Updated last year
- Huffman Coding in Shellcode Obfuscation & Dynamic Indirect Syscalls Loader.☆283Apr 6, 2025Updated 10 months ago
- A BOF that runs unmanaged PEs inline☆681Oct 23, 2024Updated last year