LOCAL AND REMOTE HOOK msv1_0!SpAcceptCredentials from LSASS.exe and DUMP DOMAIN/LOGIN/PASSWORD IN CLEARTEXT to text file.
☆122Jan 27, 2020Updated 6 years ago
Alternatives and similar repositories for LogonCredentialsSteal
Users that are interested in LogonCredentialsSteal are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Shellcode reflective DLL injection in Rust☆32May 3, 2026Updated 6 months ago
- A simple script to generate JScript code for calling Win32 API functions using XLM/Excel 4.0 macros via Excel.Application "ExecuteExcel4M…☆90Nov 9, 2019Updated 6 years ago
- Inject .Net payloads into other .Net assemblies on disk☆60Dec 12, 2019Updated 6 years ago
- A Bind Shell Using the Fax Service and a DLL Hijack☆334May 3, 2020Updated 6 years ago
- Zipper, a CobaltStrike file and folder compression utility.☆222Jan 18, 2020Updated 6 years ago
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- Create a minidump of the LSASS process from memory☆257Nov 2, 2022Updated 4 years ago
- .NET 4.0 WinRM API Command Execution☆165Sep 11, 2020Updated 6 years ago
- Cobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks b…☆466Mar 8, 2023Updated 3 years ago
- ☆180Feb 3, 2021Updated 5 years ago
- foolav successor - loads DLL, executable or shellcode into memory and runs it effectively bypassing AV☆109Aug 23, 2021Updated 5 years ago
- SharpClipHistory is a .NET application written in C# that can be used to read the contents of a user's clipboard history in Windows 10 st…☆201Jan 23, 2020Updated 6 years ago
- Run Rubeus via Rundll32☆214Apr 25, 2020Updated 6 years ago
- Collection of Beacon Object Files☆642Nov 1, 2022Updated 4 years ago
- Custom Metasploit post module to executing a .NET Assembly from Meterpreter session☆343Jul 21, 2020Updated 6 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Using DInvoke to patch AMSI.dll in order to bypass AMSI detections triggered when loading .NET tradecraft via Assembly.Load().☆216Mar 5, 2020Updated 6 years ago
- A simple reverse ssh/proxy implant PoC for *nix systems.☆57Jul 5, 2024Updated 2 years ago
- Windows PE - TLS (Thread Local Storage) Injector in C/C++☆108Jan 3, 2021Updated 5 years ago
- Extracts all base64 ticket data from a rubeus /dump file and converts the tickets to ccache files for easy use with other tools.☆67Oct 3, 2020Updated 6 years ago
- Fileless lateral movement tool that relies on ChangeServiceConfigA to run command☆1,675Jul 10, 2023Updated 3 years ago
- Load/Inject .NET assemblies by; reusing the host (spawnto) process loaded CLR AppDomainManager, Stomping Loader/.NET assembly PE DOS head…☆598Jul 26, 2021Updated 5 years ago
- Demos of Donut used in conferences, etc. Mostly for my use, but free for others to use as a reference.☆30Nov 6, 2019Updated 7 years ago
- PoC to demonstrate how CLR ETW events can be tampered.☆188Mar 26, 2020Updated 6 years ago
- RedPeanut is a small RAT developed in .Net Core 2 and its agent in .Net 3.5 / 4.0.☆330Jul 7, 2023Updated 3 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- .Net Assembly to block ETW telemetry in current process☆78May 14, 2020Updated 6 years ago
- A Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific loaded modules or pro…☆273May 3, 2023Updated 3 years ago
- GhostBuild is a collection of simple MSBuild launchers for various GhostPack/.NET projects☆253Sep 26, 2020Updated 6 years ago
- MSBuild Without MSBuild.exe☆156Dec 21, 2020Updated 5 years ago
- Tool to create hidden registry keys.☆488Oct 23, 2019Updated 7 years ago
- UAC Bypass By Abusing Kerberos Tickets☆513Aug 10, 2023Updated 3 years ago
- Dump the memory of a PPL with a userland exploit☆893Jul 24, 2022Updated 4 years ago
- Standalone version of my AES Powershell payload for Cobalt Strike.☆111Dec 27, 2019Updated 6 years ago
- .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py☆614Feb 16, 2023Updated 3 years ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- A tool employs direct registry manipulation to create scheduled tasks without triggering the usual event logs.☆642Jan 2, 2025Updated last year
- Syscall BOF to arbitrarily add/detract process token privilege rights.☆68Jul 10, 2024Updated 2 years ago
- CobaltStrike Aggressor Script to utilise FuzzySec's Windows Notification Framework Research to Spawn a Shell under Explorer.exe☆16Jul 6, 2019Updated 7 years ago
- Managed assembly shellcode generation☆282Mar 19, 2021Updated 5 years ago
- Tool to bypass LSA Protection (aka Protected Process Light)☆995Dec 4, 2022Updated 3 years ago
- Suite of Shellcode Running Utilities☆112Jan 30, 2020Updated 6 years ago
- A small .NET compression utility☆57Feb 2, 2022Updated 4 years ago