Launches a limited shell using PowerShell Runspaces with an optional AMSI Bypass. Does not invoke Powershell.exe
☆13Dec 11, 2023Updated 2 years ago
Alternatives and similar repositories for RunspaceLoader
Users that are interested in RunspaceLoader are comparing it to the libraries listed below
Sorting:
- A C# (.NET 6) tool to compare the file signature of files recursively and inform the user of matches and mismatches☆16Nov 29, 2024Updated last year
- This repository will contain source codes from the Tradecraft improvement blog series☆15Mar 27, 2025Updated 11 months ago
- This project will guide yout to awareness of injection in almost every window API and process.☆24Mar 30, 2022Updated 3 years ago
- Windows Thread Pool Injection Havoc Implementation☆34Mar 23, 2024Updated last year
- ☆58Feb 16, 2025Updated last year
- ☆60Dec 15, 2023Updated 2 years ago
- Hundred Days of Yara Challenge☆12Jun 21, 2022Updated 3 years ago
- Convert shellcode generated using pe_2_shellcode to cdb format.☆100Jan 18, 2022Updated 4 years ago
- miscellaneous codes☆36Sep 24, 2023Updated 2 years ago
- Execute shellcode from a remote-hosted bin file using Winhttp.☆239Jun 22, 2023Updated 2 years ago
- Another version of .NET loader provides capabilities of bypassing ETW and AMSI, utilizing VEH for syscalls and loading .NET assemblies☆50Jul 6, 2025Updated 8 months ago
- PowerShell tool to enumerate existing exclusions in Windows Defender as low privileged user☆11Oct 14, 2024Updated last year
- ☆10Jul 1, 2023Updated 2 years ago
- A static analyzer for PE executables.☆18Nov 19, 2021Updated 4 years ago
- Crystal Palace library for proxying Nt API calls via the Threadpool. Updated for call gadgets.☆19Nov 11, 2025Updated 4 months ago
- Investigation about ACL abusing for Active Directory Certificate Services (AD CS)☆131Oct 10, 2021Updated 4 years ago
- From C to binary shellcode converter.☆56Nov 11, 2025Updated 4 months ago
- SafeCrypt is an academic ransomware simulation suite developed for Red Team engagements. It demonstrates modern malware techniques includ…☆33Oct 3, 2025Updated 5 months ago
- Executing Kernel Routines via Syscall Table Hijack (Kernel Code Execution)☆56Jun 15, 2025Updated 9 months ago
- A list of commands, tools and notes about enumerating and exploiting Active Directory and how to defend against these attacks☆23Jun 22, 2021Updated 4 years ago
- CIA UAC bypass implementation of Stinger that obtains the token from an auto-elevated process, modifies it, and reuses it to execute as A…☆302Feb 2, 2026Updated last month
- Process hunting Toolkit is toolkit capable of hunting down malicious processes on Windows☆14Jan 31, 2025Updated last year
- Bulk export spaces from GitBook to markdown☆20Mar 10, 2025Updated last year
- Embedder is a collection of sources in different languages to embed Python interpreter with minimal dependencies☆123May 29, 2024Updated last year
- ☆12Feb 20, 2025Updated last year
- Mimikatz embedded as classes☆28Oct 25, 2021Updated 4 years ago
- An advanced AI-driven vulnerability scanner and penetration testing tool that integrates multiple AI providers (OpenAI, Grok, OLLAMA, Cla…☆35Nov 7, 2025Updated 4 months ago
- Stub for polymorphic code☆11Mar 18, 2023Updated 3 years ago
- ☆26Dec 21, 2025Updated 2 months ago
- ☆27Jun 3, 2023Updated 2 years ago
- An executable that simplifies adding the msds-AllowedToActOnBehalfOfOtherIdentity attribute for RBCD☆49Mar 10, 2025Updated last year
- This is my own implementation of the Perun's Fart technique by Sektor7☆72May 14, 2022Updated 3 years ago
- Hide your P/Invoke signatures through other people's signed assemblies☆211Mar 10, 2024Updated 2 years ago
- Windows frontend for digging SSH tunnels and creating socks proxies☆12Nov 19, 2023Updated 2 years ago
- Abuse leaked token handles.☆136Dec 14, 2023Updated 2 years ago
- Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.☆41Jul 9, 2023Updated 2 years ago
- ☆11Feb 12, 2023Updated 3 years ago
- A python polymorphic engine for C programs☆11Dec 8, 2023Updated 2 years ago
- HackSys Extreme Vulnerable Driver - StackOverflow Exploit☆32Jan 9, 2017Updated 9 years ago