Crystal port of GodPotato to abuse SeImpersonatePrivilege with indirect syscalls, dynamic API resolution and compile-time string obfuscation. Run commands, reverse shells or add users
☆132Aug 22, 2026Updated 2 months ago
Alternatives and similar repositories for CrystalPotato
Users that are interested in CrystalPotato are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- another PrivEsc potato...☆122Sep 5, 2026Updated 2 months ago
- Tool to authenticate to an LDAP/S server with a certificate through Schannel written in Rust. 🦀☆77Oct 10, 2026Updated 3 weeks ago
- ☆72Jul 12, 2026Updated 3 months ago
- This is a project aimed to make every other Saas product a C2, confluence is just the beginning.☆23Oct 21, 2026Updated 2 weeks ago
- A zero-symbol static analysis engine that extracts and mathematically ranks the Windows RPC attack surface using an AHP-based risk model.☆16Aug 26, 2026Updated 2 months ago
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- P³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure as an executi…☆247Jul 8, 2026Updated 3 months ago
- Clean Indirect Syscalls with Syscall Tampering.☆51Oct 25, 2026Updated last week
- Enumerate user accounts and registered authentication methods via the Microsoft Self-Service Password Reset (SSPR) portal☆60Sep 15, 2026Updated last month
- A credential extraction BOF for Veeam Backup and Replication and Veeam One☆82Sep 16, 2026Updated last month
- NebulaPulsar is a proof-of-concept in-memory implant framework for Java (JSP) and ASP.NET (ASPX/ASHX/ASMX) webshells, originally develope…☆47Jul 1, 2026Updated 4 months ago
- A compiled language for Windows position-independent x86-64 shellcode and Beacon Object Files.☆322Jun 28, 2026Updated 4 months ago
- Four-kit defense evasion suite for Sliver C2: Crystal Palace loader, sleep masking, in-memory PE execution, and remote process injection …☆108Jul 21, 2026Updated 3 months ago
- A stealthy process injection PoC combining Thread Name-Calling for payload delivery with Waiting Thread Hijacking for execution, with zer…☆139Oct 30, 2026Updated last week
- ☆37Sep 6, 2026Updated 2 months ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Crystal Palace PICO loader for Sliver C2 dual-layer AMSI bypass, ETW silencing, AES-256-CBC encrypted payloads, 6 delivery variants☆48Aug 20, 2026Updated 2 months ago
- ☆88Sep 21, 2026Updated last month
- OneDrive as a covert C2 transport for Cobalt Strike☆79Sep 19, 2026Updated last month
- Havoc C2 BOF port of the KslD.sys BYOVD technique. Credential extraction from lsass via physical memory — no OpenProcess, no auditable AP…☆149Apr 22, 2026Updated 6 months ago
- Custom Adaptix-compatible C2 agent - PIC beacon + Stardust UDRL + Go extender plugins☆154Oct 29, 2026Updated last week
- A stealthy and modular Windows loader designed to bypass modern EDR solutions using Module Stomping, Stack Duplication, and Advanced Slee…☆113Jul 26, 2026Updated 3 months ago
- DCOM in memory and fileless lateral movement techniques through .Net deserilization☆296Jun 22, 2026Updated 4 months ago
- Async BOF to capture KeePass master passwords by detecting and keylogging locked database windows.☆51Jul 23, 2026Updated 3 months ago
- Code and data for our paper "Onelogon: Taking over Active Directory Accounts via Netlogon" (WOOT’26).☆129Sep 1, 2026Updated 2 months ago
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- POC tool for ResetNightmare (CVE-2026-27912)☆225Aug 20, 2026Updated 2 months ago
- A PoC UDRL for Cobalt Strike built with Crystal Palace that combines Raphael Mudge's page streaming technique with a modular call gate (D…☆141Jan 21, 2026Updated 9 months ago
- A collection of BOF-PE's that allow running tailscale from memory☆141Aug 27, 2026Updated 2 months ago
- Authenticode signature manipulation toolkit for Red Team operations and security research. Covers signature stealing, metadata cloning, S…☆144Aug 13, 2026Updated 2 months ago
- Runtime Credential Guard deactivation via \\LSA_ISO_DISABLE_CREDENTIAL_GUARD + LSASS NT hash extraction (Win11 24H2)☆108Oct 27, 2026Updated last week
- BOF for Havoc that copies locked Windows files (SAM, SYSTEM, NTDS.dit) via raw MFT parsing — no VSS, no Registry APIs, no PowerShell☆137Apr 6, 2026Updated 7 months ago
- NTLM Relaying to generic web services with NTLM authentication☆85Mar 20, 2026Updated 7 months ago
- A modern Python-based Red Team Operations Workbench for managing engagements, intelligence, evidence, and reporting.☆16Aug 26, 2026Updated 2 months ago
- A Cobalt Strike BOF implementation of the SilentHarvest registry dumping technique☆185Apr 14, 2026Updated 6 months ago
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- A C# tool for extracting information from SCCM PXE boot media.☆57May 21, 2026Updated 5 months ago
- Async BOF to automatically extract or renew Kerberos TGTs on a target system.☆139Jul 23, 2026Updated 3 months ago
- CVE-2025-59501 POC code☆26Nov 20, 2025Updated 11 months ago
- A Cobalt Strike Beacon Object File that exploits the BlueHammer vulnerability that to obtain a copy of the SAM database.☆167Apr 15, 2026Updated 6 months ago
- Async port/ping scanner BOF. Supports IP/port ranges, CIDR notation and hostnames.☆20Jul 23, 2026Updated 3 months ago
- SOCKS-focused NTLM relay with persistent session packages and a long-lived SessionBank that owns authenticated TCP connections.☆41Aug 3, 2026Updated 3 months ago
- Cobalt Strike BOF to freeze EDR/AV processes and dump LSASS using WerFaultSecure.exe PPL bypass☆148Jan 29, 2026Updated 9 months ago