winterknife / PINKPANTHERLinks
Windows x64 handcrafted token stealing kernel-mode shellcode
☆510Updated last year
Alternatives and similar repositories for PINKPANTHER
Users that are interested in PINKPANTHER are comparing it to the libraries listed below
Sorting:
- Venom is a library that meant to perform evasive communication using stolen browser socket☆395Updated 2 years ago
- UAC bypass by abusing RPC and debug objects.☆628Updated 2 years ago
- PoC for a sleep obfuscation technique leveraging waitable timers to evade memory scanners.☆617Updated 2 years ago
- Shellcode injection technique. Given as C++ header, standalone Rust program or library.☆706Updated 2 years ago
- Various ways to execute shellcode☆508Updated last year
- A PoC implementation for an evasion technique to terminate the current thread and restore it before resuming execution, while implementin…☆536Updated 3 years ago
- A POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.ht…☆670Updated 3 years ago
- ☆496Updated 3 years ago
- This repository includes code and IoCs that are the product of research done in Akamai's various security research teams.☆522Updated 6 months ago
- Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs☆795Updated last year
- It's a go variant of Hells gate! (directly calling windows kernel functions, but from Go!)☆527Updated 3 years ago
- Dump the memory of a PPL with a userland exploit☆885Updated 3 years ago
- ☆607Updated 2 months ago
- Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging☆581Updated last year
- Leaked Windows processes handles identification tool☆290Updated 3 years ago
- it is very good☆517Updated 3 years ago
- Enumerating and removing kernel callbacks using signed vulnerable drivers☆585Updated 2 years ago
- PoCs and tools for investigation of Windows process execution techniques☆946Updated last month
- Hellsgate + Halosgate/Tartarosgate. Ensures that all systemcalls go through ntdll.dll☆491Updated 3 years ago
- Aims to identify sleeping beacons☆646Updated last week
- some gadgets about windows process and ready to use :)☆611Updated 2 years ago
- A way to delete a locked file, or current running executable, on disk.☆614Updated last month
- DLLirant is a tool to automatize the DLL Hijacking researches on a specified binary.☆323Updated 3 years ago
- Ivy is a payload creation framework for the execution of arbitrary VBA (macro) source code directly in memory. Ivy’s loader does this by …☆747Updated 2 years ago
- Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts wa…☆1,028Updated 2 months ago
- Project Ares is a Proof of Concept (PoC) loader written in C/C++ based on the Transacted Hollowing technique☆339Updated 3 years ago
- Sleep Obfuscation☆809Updated 2 years ago
- KaynLdr is a Reflective Loader written in C/ASM☆556Updated 2 years ago
- Encrypted PE Loader Generator☆547Updated 4 years ago
- ☆604Updated 5 months ago