Sleep Obfuscation via CreateThreadpoolTimer
☆24Jul 27, 2026Updated 3 months ago
Alternatives and similar repositories for Morpheus
Users that are interested in Morpheus are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A header-only, freestanding C++20 template for IR-bytecode VM loaders☆27May 10, 2026Updated 5 months ago
- Object File (BOF) that demonstrates privilege escalation through a misconfigured AlwaysInstallElevated policy.☆13Sep 17, 2026Updated last month
- RISC-V VM based shellcode loader PoC - Still WIP☆38Aug 1, 2026Updated 3 months ago
- BingusLdr is a DLL loader built with Crystal Palace that uses a CET compatible stack spoofing technique.☆117Jul 14, 2026Updated 3 months ago
- open source implementation of the UDC2 spec used in Cobalt Strike☆62Jul 4, 2026Updated 4 months ago
- End-to-end encrypted cloud storage - Proton Drive • AdSpecial offer: 40% Off Yearly / 80% Off First Month. Protect your most important files, photos, and documents from prying eyes.
- A CET-compatible Windows x64 loader that produces fully backed call stacks through runtime function table manipulation, code cave injecti…☆135Sep 6, 2026Updated 2 months ago
- A workshop about core UDRL mechanics by Joris Ignoul & Mickey De Baets☆23Jun 12, 2026Updated 4 months ago
- RingKiller — BYOD PoC for vulnerable driver DCRCVDrv.sys. Abuses IOCTL 0x2205C0 to kill arbitrary processes from ring 0 via ZwTerminatePr…☆26Sep 12, 2026Updated last month
- Enumerate user accounts and registered authentication methods via the Microsoft Self-Service Password Reset (SSPR) portal☆60Sep 15, 2026Updated last month
- A collection of DPAPI hunting and parsing BOFs☆39Mar 3, 2026Updated 8 months ago
- AuthStrike is an identity and authentication security testing tool for controlled simulations, security research, and education purpose o…☆22Sep 9, 2026Updated last month
- NØW is a word-based shellcode encoding and obfuscation tool that transforms raw shellcode bytes into natural-looking English prose.☆92Jun 24, 2026Updated 4 months ago
- Gain shellcode execution via T4 Text Transform files/TextTransoform.exe☆87Oct 23, 2026Updated 2 weeks ago
- Reversed cassandra source code for educational purposes☆36Jul 3, 2026Updated 4 months ago
- Bare Metal GPUs on DigitalOcean Gradient AI • AdPurpose-built for serious AI teams training foundational models, running large-scale inference, and pushing the boundaries of what's possible.
- Async BOF for NTLMv2 Hash Snooping from ETW☆13Apr 2, 2026Updated 7 months ago
- A community maintained repository of Beacon Object Files (BOFs) for red team operations, research, and education. Our goal is to provide …☆34Aug 8, 2026Updated 2 months ago
- A python proof of concept tool to assist in your payloads classification against EDR/AV's machine learning models☆39Oct 14, 2026Updated 3 weeks ago
- EDR evasion uses stealth injection via SendMessage with WM_SETTEXT to effective bypass EDR (Endpoint Detection and Response)☆78Oct 18, 2026Updated 3 weeks ago
- Mythic C2 agent with a full in-memory BOF loader for macOS and Linux☆110Sep 16, 2026Updated last month
- Ask the Web Account Manager (WAM) for Entra ID tokens☆167Sep 11, 2026Updated last month
- A proof of concept that makes a Windows syscall look like it came from a legitimate Windows thread pool, with no trace of your own code a…☆15Jul 15, 2026Updated 3 months ago
- ☆37May 19, 2026Updated 5 months ago
- Shroudware is a compile-time obfuscation library implemented entirely in the C preprocessor.☆26Apr 12, 2026Updated 6 months ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Pure-impacket parallel local-admin discovery via RBCD.☆47Oct 9, 2026Updated 3 weeks ago
- Reimplementing Havoc Pro Runtime Channel Switching and Cobalt Strike UDC2 features.☆57Oct 11, 2026Updated 3 weeks ago
- ☆25Oct 27, 2026Updated last week
- Hades is a fully-featured cross-platform Chrome Extension agent. Hades is designed for Mythic 3.0 and newer.☆49Aug 12, 2026Updated 2 months ago
- ☆32Oct 22, 2026Updated 2 weeks ago
- A Position Independent Code (PIC) implementation of the execute-assembly command built with Crystal Palace.☆22Oct 4, 2026Updated last month
- A collection of BOF-PE's that allow running tailscale from memory☆141Aug 27, 2026Updated 2 months ago
- Windows Kernel-Mode Shellcode Development Framework (WKMSDF)☆91Aug 1, 2026Updated 3 months ago
- A compiled language for Windows position-independent x86-64 shellcode and Beacon Object Files.☆322Jun 28, 2026Updated 4 months ago
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- Cobalt Strike BOF that extracts selected Windows registry hives directly from a raw NTFS volume by parsing NTFS metadata and reading file…☆112Oct 11, 2026Updated 3 weeks ago
- An NTP channel for Beacons, implemented using Cobalt Strike’s External C2 framework.☆35Oct 6, 2025Updated last year
- Surgical UNWIND_INFO preservation for sleep masking without call stack spoofing.☆56Mar 30, 2026Updated 7 months ago
- Demonstration of the DLL party process injection technique☆99Oct 1, 2026Updated last month
- Cuban Eight is a red team tool that packages a Windows PE payload into a .wsl file spoofing a real Linux distro installer. Double-click t…☆33Oct 16, 2026Updated 3 weeks ago
- SharpWSUS is a c# tool for abusing Microsoft Windows Server Update Services for Lateral Movement☆11Nov 20, 2022Updated 3 years ago
- A stealthy process injection PoC combining Thread Name-Calling for payload delivery with Waiting Thread Hijacking for execution, with zer…☆140Oct 30, 2026Updated last week