sliverarmory / C2-Tool-CollectionLinks
A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techniques.
☆16Updated last year
Alternatives and similar repositories for C2-Tool-Collection
Users that are interested in C2-Tool-Collection are comparing it to the libraries listed below
Sorting:
- A fast TCP/UDP tunnel over HTTP☆22Updated 8 months ago
- The OUned project automating Active Directory Organizational Units ACL exploitation through gPLink poisoning☆144Updated 6 months ago
- This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone…☆208Updated 11 months ago
- ☆227Updated 11 months ago
- A tool for coercing and relaying Kerberos authentication over DCOM and RPC.☆137Updated 2 months ago
- ☆213Updated last year
- Weaponizing DCOM for NTLM Authentication Coercions☆164Updated 3 months ago
- Tool for Active Directory Certificate Services enumeration and abuse☆164Updated 5 months ago
- ☆29Updated last year
- Attempt at Obfuscated version of SharpCollection☆221Updated 3 weeks ago
- Determine if the WebClient Service (WebDAV) is running on a remote system☆140Updated last year
- psexecsvc - a python implementation of PSExec's native service implementation☆217Updated 7 months ago
- A tool for enumerating potential hosts that are open to GSSAPI abuse within Active Directory networks☆174Updated last month
- ☆192Updated 6 months ago
- A PoC to deploy a Sliver Agent with amsi bypass, process injection, hollowing and OpSec☆24Updated last year
- IronSharpPack is a repo of popular C# projects that have been embedded into IronPython scripts that execute an AMSI bypass and then refle…☆116Updated last year
- Build sneaky & malicious LNK files.☆146Updated 2 months ago
- .NET Post-Exploitation Utility for Abusing Explicit Certificate Mappings in ADCS☆149Updated 7 months ago
- ☆91Updated 8 months ago
- Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods☆124Updated 2 years ago
- Impack-only implementation of WinRM protocol with support for NTLM and Kerberos auth☆39Updated 2 months ago
- ☆203Updated last year
- BOF and Python3 implementation of technique to unbind 445/tcp on Windows via SCM interactions☆331Updated 10 months ago
- A Python POC for CRED1 over SOCKS5☆158Updated last year
- ☆147Updated 5 months ago
- Tool designed to find folder exclusions using Windows Defender using command line utility MpCmdRun.exe as a low privileged user, without …☆217Updated last year
- ☆71Updated 6 months ago
- Null-AMSI is an AMSI and ETW bypass that takes advantage of .NET types (.NET Reflection) to bypassing AV/EDR.☆74Updated 3 months ago
- GregsBestFriend process injection code created from the White Knight Labs Offensive Development course☆196Updated 2 years ago
- C# implementation of TokenFinder. Steal M365 access tokens from Office Desktop apps☆140Updated last year