joaoviictorti / shadow-rs
Windows Kernel Rootkit in Rust
☆396Updated this week
Alternatives and similar repositories for shadow-rs:
Users that are interested in shadow-rs are comparing it to the libraries listed below
- Rusty Arsenal - A collection of experimental Process Injection and Post-Exploitation Techniques in Rust☆245Updated last year
- Experimental Windows x64 Kernel Rootkit with anti-rootkit evasion features.☆521Updated this week
- Threadless Process Injection through entry point hijacking☆342Updated 5 months ago
- ROP-based sleep obfuscation to evade memory scanners☆327Updated last week
- Rusty Bootkit - Windows UEFI Bootkit in Rust (Codename: RedLotus)☆522Updated last year
- Rusty Rootkit - Windows Kernel Rookit in Rust (Codename: Eagle)☆543Updated last year
- ☆214Updated last month
- Reflective x64 PE/DLL Loader implemented using Dynamic Indirect Syscalls☆359Updated 4 months ago
- COM ViewLogger — new malware keylogging technique☆341Updated last month
- Rusty Injection - Shellcode Reflective DLL Injection (sRDI) in Rust (Codename: Venom)☆333Updated 11 months ago
- FaceDancer is an exploitation tool aimed at creating hijackable, proxy-based DLLs by taking advantage of COM-based system DLL image loadi…☆250Updated 4 months ago
- Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.☆273Updated 8 months ago
- Windows Defender Killer | C++ Code Disabling Permanently Windows Defender using Registry Keys☆442Updated last year
- Template-based shellcode packer written in Rust, with indirect syscall support. Made with <3 for pentesters.☆265Updated 6 months ago
- ☆246Updated 6 months ago
- Complete list of LPE exploits for Windows (starting from 2023)☆744Updated this week
- Shoggoth: Asmjit Based Polymorphic Encryptor☆705Updated 10 months ago
- Dynamically invoke arbitrary unmanaged code☆331Updated 3 months ago
- Evasive shellcode loader☆343Updated 4 months ago
- Call stack spoofing for Rust☆317Updated 2 weeks ago
- Single stub direct and indirect syscalling with runtime SSN resolving for windows.☆208Updated last year
- Collect Windows telemetry for Maldev☆298Updated 2 weeks ago
- Proof of Concept for manipulating the Kernel Callback Table in the Process Environment Block (PEB) to perform process injection and hijac…☆203Updated 3 months ago
- A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.☆333Updated last week
- Local Privilege Escalation from Admin to Kernel vulnerability on Windows 10 and Windows 11 operating systems with HVCI enabled.☆285Updated 10 months ago
- Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird …☆628Updated 4 months ago
- PoCs for Kernelmode rootkit techniques research.☆354Updated last month
- Performing Indirect Clean Syscalls☆514Updated last year
- LPE exploit for CVE-2023-21768☆486Updated last year
- Bear C2 is a compilation of C2 scripts, payloads, and stagers used in simulated attacks by Russian APT groups, Bear features a variety of…☆327Updated 4 months ago