xct / adopt
Spawns a process from a process. Can sometimes be used to run a session > 0 process from session 0.
☆14Updated 2 years ago
Alternatives and similar repositories for adopt:
Users that are interested in adopt are comparing it to the libraries listed below
- Secretsdump C# version only supporting local (live) operation☆48Updated last year
- Beacon Object Files (not Buffer Overflows)☆53Updated last year
- SharpExShell automates the DCOM lateral movment technique which abuses ActivateMicrosoftApp method of Excel application.☆68Updated 9 months ago
- Run Cobalt Strike BOFs in Brute Ratel C4!☆61Updated last month
- Lateral Movement via the .NET Profiler☆79Updated 3 months ago
- Modified versions of the Cobalt Strike Process Injection Kit☆92Updated last year
- SAM Dumping in C#☆42Updated last month
- ☆93Updated 5 months ago
- An old Windows workstations LPE for domain environments without LDAP signing/channel binding.☆31Updated 2 years ago
- Click Once + App Domain☆62Updated last year
- A care package of useful bofs for red team engagments☆54Updated 2 months ago
- HelpSystems Nanodump, but wrapped in powershell via Invoke-ReflectivePEInjection☆53Updated 3 years ago
- ☆52Updated last month
- Python3 rewrite of AsOutsider features of AADInternals☆40Updated 2 months ago
- GPOAnalyzer is a tool designed to assist in parsing domain Group Policy Object (GPO) files located in the SYSVOL directory.☆25Updated 8 months ago
- time-based user enum via Basic Auth in Azure against Autodiscover☆31Updated 4 months ago
- Tool to bypass LSA Protection (aka Protected Process Light)☆44Updated last month
- Programmatically start WebClient from an unprivileged session to enable that juicy privesc.☆73Updated 2 years ago
- ☆47Updated last year
- Lockless BOF☆65Updated 2 weeks ago
- ☆45Updated 2 years ago
- Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.☆39Updated last year
- ☆47Updated 2 years ago
- lsassdump via RtlCreateProcessReflection and NanoDump☆76Updated 4 months ago
- Simple .NET loader for loading and executing Powershell payloads☆16Updated 3 years ago
- A version of NetLoader, Execute Assemblies and Bypass ETW and AMSI using Hardware Breakpoints☆74Updated last month