RingKiller — BYOD PoC for vulnerable driver DCRCVDrv.sys. Abuses IOCTL 0x2205C0 to kill arbitrary processes from ring 0 via ZwTerminateProcess. EDR/AV termination primitive. Lab only.
☆26Sep 12, 2026Updated last month
Alternatives and similar repositories for RingKiller
Users that are interested in RingKiller are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Active Directory forensic framework☆16May 18, 2026Updated 5 months ago
- Sleep Obfuscation via CreateThreadpoolTimer☆24Jul 27, 2026Updated 2 months ago
- ☆37Sep 6, 2026Updated last month
- Reverse engineering analysis of PureRAT, a multi-stage RAT that executes via msbuild.exe and communicates with C2 servers at pure8s.ddnsf…☆17Sep 21, 2026Updated 3 weeks ago
- The swiss army knife of LSASS dumping☆14Jan 4, 2026Updated 9 months ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- SVG Steganography toolkit☆16Jun 18, 2026Updated 4 months ago
- Rust based C2 Framework☆33Sep 29, 2026Updated 3 weeks ago
- Enumerate user accounts and registered authentication methods via the Microsoft Self-Service Password Reset (SSPR) portal☆57Sep 15, 2026Updated last month
- Snaffler in Python☆121Oct 1, 2026Updated 2 weeks ago
- Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.☆108Oct 1, 2026Updated 2 weeks ago
- SmuggleMyPayload generates HTML pages that embed and reconstruct files client-side using JavaScript. The toolkit offers multiple HTML Smu…☆54Oct 13, 2026Updated last week
- Undetectable offensive toolkit inside Chrome☆146Aug 27, 2026Updated last month
- Process Explorer vulnerable driver PPL Bypass☆27Sep 30, 2026Updated 2 weeks ago
- AuthStrike is an identity and authentication security testing tool for controlled simulations, security research, and education purpose o…☆20Sep 9, 2026Updated last month
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Custom Adaptix-compatible C2 agent - PIC beacon + Stardust UDRL + Go extender plugins☆145Oct 4, 2026Updated 2 weeks ago
- A single archive of public exploit PoCs and vulnerability research writeups. At the time I post these, none have been reported. Feel free…☆21Sep 18, 2026Updated last month
- ☆55Sep 18, 2026Updated last month
- Pure-impacket parallel local-admin discovery via RBCD.☆47Oct 9, 2026Updated last week
- Open Source implementation of PsPipeJack☆27May 27, 2026Updated 4 months ago
- PIC shellcode agent based on Stardust framework and Crystal Palace☆92Oct 4, 2026Updated 2 weeks ago
- Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv…☆114Oct 6, 2026Updated 2 weeks ago
- Browser Bookmark that will ask for keyword(s) and then color highlight these words on the webpage you visit☆12Nov 15, 2023Updated 2 years ago
- Cobalt Strike Beacon Object File to to change the user's desktop wallpaper☆18Sep 15, 2023Updated 3 years ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Cross-platform network execution toolkit (SMB/Kerberos/WMI/LDAP/DCSync) built on TrustedSec's Titanis - NetExec-style workflow in C#☆83Sep 18, 2026Updated last month
- Ask the Web Account Manager (WAM) for Entra ID tokens☆161Sep 11, 2026Updated last month
- Transmit malware payload via sound: DFT + FSK + Goertzel algorithm + IDFT☆22Oct 2, 2026Updated 2 weeks ago
- Tool to authenticate to an LDAP/S server with a certificate through Schannel written in Rust. 🦀☆77Oct 10, 2026Updated last week
- POC tool for ResetNightmare (CVE-2026-27912)☆224Aug 20, 2026Updated 2 months ago
- Crystal port of GodPotato to abuse SeImpersonatePrivilege with indirect syscalls, dynamic API resolution and compile-time string obfuscat…☆131Aug 22, 2026Updated last month
- A newly discovered vulnerable driver, pstrip64.sys (CVE-2026-29923) allows an unprivileged user to escalate privileges to SYSTEM via a cr…☆26Apr 11, 2026Updated 6 months ago
- a lightweight, fast, and fully portable reimplementation of Impacket in TypeScript and JavaScript.☆28Sep 2, 2026Updated last month
- Harness fo malware analysis☆41Aug 23, 2026Updated last month
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- Process Impairment Exploit Chain.☆36Aug 12, 2026Updated 2 months ago
- PPLwindow PPL Bypass via GetProcessHandleFromHwnd☆55Dec 29, 2025Updated 9 months ago
- P³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure as an executi…☆241Jul 8, 2026Updated 3 months ago
- Dumping all keys from a keytab file☆21Dec 1, 2025Updated 10 months ago
- 渗透测试人员可以通过此BOF，将非托管 Windows可执行文件加载到Beacon内存中并执行它们，检索输出并将其呈现在 Beacon 控制台中☆13Mar 18, 2025Updated last year
- Service Extender for notifying about AdaptixC2 events in Telegram, Slack, Rocket.Char, Discord, and any web platforms, such as ntfy.sh.☆22Mar 4, 2026Updated 7 months ago
- ☆22Jun 28, 2026Updated 3 months ago