Alternatives and similar repositories for blackhat-usa-2022-demos

Users that are interested in blackhat-usa-2022-demos are comparing it to the libraries listed below

• Henkru / cs-token-vault

  View on GitHub
  In-memory token vault BOF for Cobalt Strike
  ☆149Aug 18, 2022Updated 3 years ago
• mdsecactivebreach / DragonCastle

  View on GitHub
  A PoC that combines AutodialDLL lateral movement technique and SSP to scrape NTLM hashes from LSASS process.
  ☆301Oct 26, 2022Updated 3 years ago
• netero1010 / RDPHijack-BOF

  View on GitHub
  Cobalt Strike Beacon Object File (BOF) that uses WinStationConnect API to perform local/remote RDP session hijacking.
  ☆312Jul 8, 2022Updated 3 years ago
• EspressoCake / Defender_Exclusions-BOF

  View on GitHub
  A BOF to determine Windows Defender exclusions.
  ☆253Jun 25, 2023Updated 2 years ago
• nettitude / MalSCCM

  View on GitHub
  ☆252Sep 28, 2023Updated 2 years ago
• Yaxser / COFFLoader2

  View on GitHub
  Load and execute COFF files and Cobalt Strike BOFs in-memory
  ☆226Sep 13, 2022Updated 3 years ago
• kyleavery / AceLdr

  View on GitHub
  Cobalt Strike UDRL for memory scanner evasion.
  ☆1,004Jun 4, 2024Updated last year
• thefLink / DeepSleep

  View on GitHub
  A variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC
  ☆373May 24, 2022Updated 3 years ago
• praetorian-inc / ADFSRelay

  View on GitHub
  Proof of Concept Utilities Developed to Research NTLM Relaying Attacks Targeting ADFS
  ☆187Jun 22, 2022Updated 3 years ago
• hackerhouse-opensource / iscsicpl_bypassUAC

  View on GitHub
  UAC bypass for x64 Windows 7 - 11
  ☆831Feb 2, 2026Updated 2 weeks ago
• m3rcer / Chisel-Strike

  View on GitHub
  A .NET XOR encrypted cobalt strike aggressor implementation for chisel to utilize faster proxy and advanced socks5 capabilities.
  ☆460Mar 25, 2024Updated last year
• trustedsec / CS-Remote-OPs-BOF

  View on GitHub
  ☆1,117Jan 6, 2026Updated last month
• eladshamir / RPC-Backdoor

  View on GitHub
  A basic emulation of an "RPC Backdoor"
  ☆242Aug 25, 2022Updated 3 years ago
• fortra / CreateProcess

  View on GitHub
  A small PoC that creates processes in Windows
  ☆187Jun 6, 2024Updated last year
• RedTeamPentesting / pretender

  View on GitHub
  Your MitM sidekick for relaying attacks featuring DHCPv6 DNS takeover as well as mDNS, LLMNR and NetBIOS-NS spoofing.
  ☆1,258Dec 9, 2025Updated 2 months ago
• zimawhit3 / Bitmancer

  View on GitHub
  Nim Library for Offensive Security Development
  ☆197Sep 4, 2023Updated 2 years ago
• cube0x0 / BofRoast

  View on GitHub
  Beacon Object Files for roasting Active Directory
  ☆235Feb 21, 2022Updated 3 years ago
• Dec0ne / ShadowSpray

  View on GitHub
  A tool to spray Shadow Credentials across an entire domain in hopes of abusing long forgotten GenericWrite/GenericAll DACLs over other ob…
  ☆482Oct 14, 2022Updated 3 years ago
• Cracked5pider / CoffeeLdr

  View on GitHub
  Beacon Object File Loader
  ☆294Dec 3, 2023Updated 2 years ago
• Bdenneu / CVE-2022-33679

  View on GitHub
  One day based on https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html
  ☆415Nov 10, 2024Updated last year
• waawaa / AMSI_Rubeus_bypass

  View on GitHub
  ☆72Aug 2, 2022Updated 3 years ago
• mgeeky / msi-shenanigans

  View on GitHub
  Proof of Concept code and samples presenting emerging threat of MSI installer files.
  ☆90Dec 15, 2022Updated 3 years ago
• Octoberfest7 / Inline-Execute-PE

  View on GitHub
  Execute unmanaged Windows executables in CobaltStrike Beacons
  ☆714Mar 4, 2023Updated 2 years ago
• securifybv / Visual-Studio-BOF-template

  View on GitHub
  A Visual Studio template used to create Cobalt Strike BOFs
  ☆323Nov 17, 2021Updated 4 years ago
• rad9800 / TamperingSyscalls

  View on GitHub
  ☆504Aug 14, 2022Updated 3 years ago
• cube0x0 / LdapSignCheck

  View on GitHub
  Beacon Object File & C# project to check LDAP signing
  ☆199Aug 7, 2024Updated last year
• MzHmO / psexec_noinstall

  View on GitHub
  Repository contains psexec, which will help to exploit the forgotten pipe
  ☆171Nov 5, 2024Updated last year
• crisprss / magicNetdefs

  View on GitHub
  Similar to Petitpotam, the netdfs service is enabled in Windows Server and AD environments, and the abused RPC method allows privileged p…
  ☆49Jun 21, 2022Updated 3 years ago
• janoglezcampos / DeathSleep

  View on GitHub
  A PoC implementation for an evasion technique to terminate the current thread and restore it before resuming execution, while implementin…
  ☆536Aug 1, 2022Updated 3 years ago
• Kudaes / Elevator

  View on GitHub
  UAC bypass by abusing RPC and debug objects.
  ☆627Oct 19, 2023Updated 2 years ago
• BeichenDream / PrintNotifyPotato

  View on GitHub
  PrintNotifyPotato
  ☆539Dec 2, 2022Updated 3 years ago
• Rvn0xsy / SchtaskCreator

  View on GitHub
  远程创建任务计划工具
  ☆190Apr 23, 2022Updated 3 years ago
• lele8 / SharpUserIP

  View on GitHub
  获取服务器或域控登录日志
  ☆276Sep 8, 2023Updated 2 years ago
• rad9800 / VehApiResolve

  View on GitHub
  ☆118Aug 7, 2022Updated 3 years ago
• paranoidninja / Proxy-DLL-Loads

  View on GitHub
  The code is a pingback to the Dark Vortex blog:
  ☆186Jan 26, 2023Updated 3 years ago
• NUL0x4C / EtwSessionHijacking

  View on GitHub
  A Poc on blocking Procmon from monitoring network events
  ☆111Aug 7, 2025Updated 6 months ago
• Dec0ne / DavRelayUp

  View on GitHub
  DavRelayUp - a universal no-fix local privilege escalation in domain-joined windows workstations where LDAP signing is not enforced (the …
  ☆565Jun 5, 2023Updated 2 years ago
• CodeXTF2 / Burp2Malleable

  View on GitHub
  Quick python utility I wrote to turn HTTP requests from burp suite into Cobalt Strike Malleable C2 profiles
  ☆418Apr 6, 2023Updated 2 years ago
• Octoberfest7 / MemFiles

  View on GitHub
  A CobaltStrike toolkit to write files produced by Beacon to memory instead of disk
  ☆473Jul 6, 2024Updated last year