Manage Shadows Copies via the VSS API using C#, C++, Crystal or Python. Working on Windows 11
☆84Jan 26, 2026Updated last month
Alternatives and similar repositories for w11_shadow_copies
Users that are interested in w11_shadow_copies are comparing it to the libraries listed below
Sorting:
- A small experiment on assigning a processes threads a specific CPU and then blocking it with a high priority thread☆30Sep 24, 2025Updated 5 months ago
- Automated DLL Hijacking Detection Tool with Zero False Positives — Discovers, filters, and canary-confirms exploitable DLL hijacks on Win…☆135Updated this week
- A cmake template for crystal palace☆39Dec 20, 2025Updated 2 months ago
- Repository to gather the BOF files I will be developing☆11Oct 1, 2024Updated last year
- CVE-2025-59501 POC code☆25Nov 20, 2025Updated 3 months ago
- Slides and resources from MCTTP 2025 Talk☆66Oct 26, 2025Updated 4 months ago
- Impersonate Tokens using only NTAPI functions☆84Apr 4, 2025Updated 11 months ago
- BOF to terminate a process via PID as argument☆28Sep 7, 2025Updated 6 months ago
- A PICO for Crystal Palace that implements CLR hosting to execute a .NET assembly in memory.☆128Jan 28, 2026Updated last month
- Extract the SAM and SYSTEM hives using the Volume Shadow Copy (VSS) API. With exfiltration and XOR obfuscation options. Implemented in C#…☆341Feb 2, 2026Updated last month
- An executable that simplifies adding the msds-AllowedToActOnBehalfOfOtherIdentity attribute for RBCD☆49Mar 10, 2025Updated 11 months ago
- Obfuscate payloads using IPv4, IPv6, MAC or UUID strings☆23Feb 17, 2024Updated 2 years ago
- Executing Shellcode with ReadDirectoryChanges’s Hidden Callback☆30Oct 13, 2025Updated 4 months ago
- Create local administrators with the SAMR API (lowest-level technique). Implemented in C#, Crystal, Python and Rust☆57Jan 27, 2026Updated last month
- Golang Automation Framework for Cobalt Strike using the Rest API☆56Dec 4, 2025Updated 3 months ago
- A BOF that's a BOF Loader and more☆199Jan 17, 2026Updated last month
- ☆171Oct 21, 2025Updated 4 months ago
- Parses cached certificate templates from a Windows Registry file and displays them in the same style as Certipy does☆95Jul 3, 2025Updated 8 months ago
- PowerShell tool that shows how to read and write NTLM OWF values via samlib.dll.☆72Oct 22, 2025Updated 4 months ago
- Beacon Object File (BOF) for Using the BadSuccessor Technique for Account Takeover☆86Oct 20, 2025Updated 4 months ago
- Cobalt Strike UDC2 implementation that provides an Slack C2 channel☆63Jan 5, 2026Updated 2 months ago
- A C# tool for extracting information from SCCM PXE boot media.☆51Jan 14, 2026Updated last month
- MacOS Shared Library to Shellcode Loader☆54Feb 23, 2026Updated 2 weeks ago
- Collection of BOFs created for red team/adversary engagements. Created to be small and interchangeable, for quick recon or eventing.☆240Feb 20, 2026Updated 2 weeks ago
- ☆38Feb 26, 2025Updated last year
- An alternative to the builtin clipboard feature in Cobalt Strike that adds the capability to enable/disable and dump the clipboard histor…☆103Jan 9, 2026Updated 2 months ago
- One WSL BOF to rule them all☆159Jan 14, 2026Updated last month
- Repository to gather the .NET malware I will be developing☆18Mar 23, 2025Updated 11 months ago
- Updated version of a long known self deletion technique to work with 24H2.☆61Jun 9, 2025Updated 9 months ago
- A portable C# utility for enumerating local and remote windows sessions☆56Jan 1, 2026Updated 2 months ago
- Bypass user-land hooks by syscall tampering via the Trap Flag☆138Aug 25, 2025Updated 6 months ago
- ☆409Dec 8, 2024Updated last year
- Remap ntdll.dll using only NTAPI functions with a suspended process☆27Apr 13, 2025Updated 10 months ago
- Shellcode Loader Utilizing ETW Events☆66Feb 26, 2025Updated last year
- ☆49Nov 7, 2024Updated last year
- NoMoreStealers is a Windows file system minifilter driver that protects sensitive user data from untrusted processes.☆97Nov 7, 2025Updated 4 months ago
- BypassCredGuard CS BOF☆51Jan 23, 2025Updated last year
- Shellcode and In-PowerShell solution for patching AMSI via Page Guard Exceptions☆63Nov 15, 2025Updated 3 months ago
- The DCERPC only printerbug.py version☆206Oct 30, 2025Updated 4 months ago