Alternatives and similar repositories for EXEC_LKM

Users that are interested in EXEC_LKM are comparing it to the libraries listed below

• loneicewolf / smbdoor
  improving zerosums smbdoor - a silent remote backdoor which abuses undoc. APIs in srvnet.sys
  ☆50Updated 2 years ago
• NUL0x4C / GP
  using the gpu to hide your payload
  ☆59Updated 3 years ago
• hasherezade / shellc_encoder
  Standalone Metasploit-like XOR encoder for shellcode
  ☆48Updated last year
• connormcgarr / Kernel-Escalation-of-Privileges-Payloads
  NT AUTHORITY\SYSTEM
  ☆39Updated 5 years ago
• MastMind / PE-infector
  Crossplatform tool for inject shellcode into .exe and .dll binaries (x86 and x64)
  ☆70Updated last year
• JohnWoodman / stealthInjector
  Injects shellcode into remote processes using direct syscalls
  ☆79Updated 4 years ago
• PL-V / Firefox-Grabber
  Grab Firefox post requests by hooking PR_Write function from nss3.dll module using trampoline hook to get passwords and emails of users
  ☆42Updated 2 years ago
• aaaddress1 / masqueradeCmdline
  A PoC to demo modifying cmdline of the child process dynamically. It might be useful against process log tracing, AV or EDR.
  ☆40Updated 4 years ago
• OccamsXor / sim-ba
  (Sim)ulate (Ba)zar Loader
  ☆29Updated 4 years ago
• aaaddress1 / sakeInject
  Windows PE - TLS (Thread Local Storage) Injector in C/C++
  ☆106Updated 4 years ago
• OtterHacker / CoffLoader
  ☆55Updated 2 years ago
• EgeBalci / Hook_API
  Assembly block for hooking windows API functions.
  ☆93Updated 6 years ago
• boku7 / x64win-DynamicNoNull-WinExec-PopCalc-Shellcode
  64bit WIndows 10 shellcode dat pops dat calc - Dynamic & Null Free
  ☆64Updated 2 years ago
• AzAgarampur / byeintegrity2-uac
  Bypass UAC by abusing the Internet Explorer Add-on installer
  ☆54Updated 4 years ago
• zerosum0x0-archive / archive
  ☆55Updated 3 years ago
• ZeroMemoryEx / Overlord
  abusing Process Hacker driver to terminate other processes (BYOVD)
  ☆83Updated 2 years ago
• ethereal-vx / Persistence
  Recreating and reviewing the Windows persistence methods
  ☆39Updated 3 years ago
• 0x44F / WinKit
  💻 Windows 10 Kernel-mode rootkit
  ☆32Updated 3 years ago
• knight0x07 / BumbleCrypt
  A Bumblebee-inspired Crypter
  ☆79Updated 2 years ago
• h3xduck / Umbra
  A LKM rootkit targeting 4.x and 5.x kernel versions which opens a backdoor that can spawn a reverse shell to a remote host, launch malwar…
  ☆129Updated 3 years ago
• WithSecureLabs / TickTock
  ☆112Updated 2 years ago
• EgeBalci / IAT_API
  Assembly block for finding and calling the windows API functions inside import address table(IAT) of the running PE file.
  ☆77Updated 2 years ago
• elastic / PPLGuard
  ☆70Updated 6 months ago
• enkomio / BrokenFlow
  A simple PoC to invoke an encrypted shellcode by using an hidden call
  ☆116Updated 2 years ago
• dis0rder0x00 / CanYouCTheThief
  A C implementation of the Sektor7 "A Thief" Windows privesc technique.
  ☆65Updated 3 years ago
• Hagrid29 / herpaderply_hollowing
  Herpaderply Hollowing - a PE injection technique, hybrid between Process Hollowing and Process Herpaderping
  ☆63Updated 2 years ago
• Allevon412 / PPL_Sandboxer
  ☆82Updated 3 years ago
• redcode-labs / Solaris
  A local LKM rootkit loader/dropper that lists available security mechanisms
  ☆52Updated 4 years ago
• thefLink / Memfiddler
  Executes shellcode from a remote server and aims to evade in-memory scanners
  ☆31Updated 5 years ago
• plackyhacker / Unhook-BitDefender
  Unhooks Bit Defender from NTDLL and KERNELBASE using a classic technique.
  ☆56Updated 2 years ago