zimnyaa / nim-noload-dll-hollowingLinks
Unused DLL hollowing PoC in Nim
☆17Updated 3 years ago
Alternatives and similar repositories for nim-noload-dll-hollowing
Users that are interested in nim-noload-dll-hollowing are comparing it to the libraries listed below
Sorting:
- PoC XLL builder in Python/Nim☆47Updated 2 years ago
- Sleep Obfuscation☆45Updated 2 years ago
- ☆43Updated last year
- yet another sleep encryption thing. also used the default github repo name for this one.☆69Updated 2 years ago
- An insecurely implemented and installed Windows service for emulating elevation of privileges vulnerabilities☆62Updated 3 years ago
- A nim port of C5pider's Ekko project.☆17Updated 3 years ago
- A simple Nim stager (w/ fiber execution)☆18Updated 3 years ago
- Windows x64 Process Injection via Ghostwriting with Dynamic Configuration☆29Updated 3 years ago
- Beacon Object Files (not Buffer Overflows)☆56Updated 2 years ago
- all credits go to @mgeeky☆64Updated 3 years ago
- ☆47Updated 2 years ago
- GhostLoader - AppDomainManager - Injection - 攻壳机动队☆52Updated 5 years ago
- ShellcodeFluctuation PoC ported to Nim☆79Updated 2 years ago
- A method to execute shellcode using RegisterWaitForInputIdle API.☆55Updated 2 years ago
- Cobalt Strike Beacon Object File to enable the webdav client service on x64 windows hosts☆22Updated 2 years ago
- Small tool to play with IOCs caused by Imageload events☆42Updated 2 years ago
- A repository filled with ideas to break/detect direct syscall techniques☆27Updated 3 years ago
- Self Delete DLL☆23Updated last year
- ☆31Updated 2 years ago
- idk man this was the default github name☆35Updated 2 years ago
- DLL proxy load example using the Windows thread pool API, I/O completion callback with named pipes, and C++/assembly☆62Updated last year
- ☆62Updated 3 years ago
- This project is an EDRSandblast fork, adding some features and custom pieces of code.☆23Updated 2 years ago
- Unchain AMSI by patching the provider’s unmonitored memory space☆91Updated 2 years ago
- A tracker DLL which enables 'NTAPI->Syscall' tracking whenever it is loaded. It calls 'NtSetInformationProcess' API call with a callback …☆12Updated 11 months ago
- Example of using Sleep to create better named pipes.☆41Updated 2 years ago
- Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.☆40Updated 2 years ago
- Basic implementation of Cobalt Strikes - User Defined Reflective Loader feature☆102Updated 2 years ago
- Simple PoC to locate hooked functions by EDR in ntdll.dll☆38Updated 2 years ago
- Tool for playing with Windows Access Token manipulation.☆55Updated 2 years ago