seahop Goto Github PK

privesccheck

Privilege Escalation Enumeration Script for Windows

privfu

Kernel mode WinDbg extension and PoCs for token privilege investigation.

process-cloning

The Definitive Guide To Process Cloning on Windows

process_ghosting

Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file

processhide

protectmytooling

Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking, IOCs collection & PE Backdooring. You feed it with your implant, it does a lot of sneaky things and spits out obfuscated executable.

proxycalls

miscellaneous codes

psnotifroutineunloader

This script is used to unload PsSetCreateProcessNotifyRoutineEx, PsSetCreateProcessNotifyRoutine, PsSetLoadImageNotifyRoutine and PsSetCreateThreadNotifyRoutine from ESET Security to bypass the driver detection

psudohash

Password list generator that focuses on keywords mutated by commonly used password creation patterns

pyportscan_periface

pypykatz

Mimikatz implementation in pure Python

pyxor_bin

randomtsscripts

Collection of random RedTeam scripts.

ransomwhere

A PoC ransomware sample to test out your ransomware response strategy.

recycledgate

Hellsgate + Halosgate/Tartarosgate. Ensures that all systemcalls go through ntdll.dll

redteamccode

Red Team C code repo

redteaming-tactics-and-techniques

Red Teaming Tactics and Techniques

remoteprocdllinject

remoteshellcodeexec

Execute shellcode from a remote-hosted bin file using Winhttp.

remoteshellcodeinjection_xor

responder

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.

revenant

Revenant - A 3rd party agent for Havoc that aims to demonstrate evasion techniques in the context of a C2 framework

rubeus

Trying to tame the three-headed dog.

runpe

C# Reflective loader for unmanaged binaries.

runpe-in-memory

Run a Exe File (PE Module) in memory (like an Application Loader)

rwxfinder

The program uses the Windows API functions to traverse through directories and locate DLL files with RWX section

scarecrow

ScareCrow - Payload creation framework designed around EDR bypass.

screenshot-bof

screenshotbof

An alternative screenshot capability for Cobalt Strike that uses WinAPI and does not perform a fork & run. Screenshot saved to disk as a file.

seatbelt

Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.