A Rust template for writing Beacon Object Files (BOFs)
☆101Feb 11, 2026Updated 3 weeks ago
Alternatives and similar repositories for rustbof
Users that are interested in rustbof are comparing it to the libraries listed below
Sorting:
- A synergized Visual Studio and Rust development environment☆19Jan 25, 2025Updated last year
- ☆26Aug 11, 2025Updated 6 months ago
- Call Stack Spoofing for Rust☆210Jan 28, 2026Updated last month
- A remote process injection using process snapshotting based on https://gitlab.com/ORCA000/snaploader , in rust. It creates a sacrificial …☆50Jan 25, 2025Updated last year
- 64-bit, position-independent implant template for Windows in Rust.☆175Nov 28, 2025Updated 3 months ago
- ☆55May 31, 2025Updated 9 months ago
- A rust proof of concept to demonstrate registry overwriting via RegRestoreKey using the Offline Registry Library☆24Nov 13, 2025Updated 3 months ago
- Beacon Debugger☆55Oct 28, 2024Updated last year
- Enable EFS service as low priv user (PE & BOF)☆21Jul 6, 2025Updated 8 months ago
- Cobaltstrike UDRL with memory evasion☆15May 16, 2024Updated last year
- A Rust PoC implementation of the Early Bird process hollowing technique, inspired by https://github.com/boku7/HOLLOW.☆31Feb 7, 2025Updated last year
- A Rust port of LayeredSyscall — performs indirect syscalls while generating legitimate API call stack frames by abusing VEH.☆164Oct 31, 2024Updated last year
- A collection of position independent coding resources☆107Nov 15, 2025Updated 3 months ago
- A tracker DLL which enables 'NTAPI->Syscall' tracking whenever it is loaded. It calls 'NtSetInformationProcess' API call with a callback …☆14Oct 21, 2024Updated last year
- Just a nice little shellcode loader using unconventional methods to avoid using signatured APIs☆23Jul 11, 2025Updated 7 months ago
- A truly Position Independent Code (PIC) NimPlant C2 beacon written in C, without reflective loading.☆67Feb 11, 2025Updated last year
- BOF with Synthetic Stackframe☆230Oct 30, 2025Updated 4 months ago
- Proof of Concept (PoC) implant for creating custom Cobalt Strike Beacons☆180Feb 11, 2026Updated 3 weeks ago
- [EMNLP 2024] Holistic Automated Red Teaming for Large Language Models through Top-Down Test Case Generation and Multi-turn Interaction☆17Nov 9, 2024Updated last year
- find dll base addresses without PEB WALK☆161Jul 13, 2025Updated 7 months ago
- Rust template/library for implementing your own COFF loader☆72Jan 27, 2025Updated last year
- An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution☆195Nov 27, 2024Updated last year
- Prevent in-process process termination by patching exit APIs☆63Nov 9, 2025Updated 3 months ago
- BYOVD: Use 360 WFP driver to block EDR/XDR network connection.☆103Feb 10, 2026Updated 3 weeks ago
- early cascade injection PoC based on Outflanks blog post, in rust☆62Nov 8, 2024Updated last year
- Utilizng an MCP Server to communicate with your C2☆86May 15, 2025Updated 9 months ago
- Remote BOF Runner is a Havoc extension framework for remote execution of Beacon Object Files (BOFs) using a PIC loader made with Crystal …☆89Jan 2, 2026Updated 2 months ago
- Mentally ill EtwTi parser☆68Jan 11, 2026Updated last month
- BOF that finds all the Nt* system call stubs within NTDLL and overwrites with clean syscall stubs (user land hook evasion)☆195Feb 6, 2025Updated last year
- Shellcode Loader using indirect syscalls☆16Jan 21, 2024Updated 2 years ago
- a demo module for the kaine agent to execute and inject assembly modules☆41Aug 28, 2024Updated last year
- use python on windows with full submodule support without installation☆30Jan 23, 2025Updated last year
- NSecSoftBYOVD POC☆58Feb 12, 2026Updated 3 weeks ago
- ☆101Oct 7, 2023Updated 2 years ago
- Slides for COM Hijacking AV/EDR Talk on 38c3☆75Jan 3, 2025Updated last year
- ☆20Jan 14, 2026Updated last month
- C++ Staged Shellcode Loader with Evasion capabilities.☆96Oct 7, 2024Updated last year
- Indirect syscalls + DInvoke made simple.☆96Dec 24, 2024Updated last year
- Stack Spoofing with Synthetic frames based on the work of namazso, SilentMoonWalk, and VulcanRaven☆263Oct 16, 2024Updated last year