sliverarmory Goto Github PK

amd-ryzen-master-driver-v17-exploit

Cobalt Strike (CS) Beacon Object File (BOF) for kernel exploitation using AMD's Ryzen Master Driver (version 17).

armory

The Official Sliver Armory

azbelt

AAD related enumeration in Nim

bof-collection

Collection of Beacon Object Files (BOF) for Cobalt Strike

bof-patchit

An all-in-one Cobalt Strike BOF to patch, check and revert AMSI and ETW for x64 process. Both syscalls and dynamic resolve versions are available.

bofroast

Beacon Object Files for roasting Active Directory

bofs

Collection of Beacon Object Files

c2-tool-collection

A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techniques.

certify

Active Directory certificate abuse.

chisel

A fast TCP/UDP tunnel over HTTP

coffloader

credmanbof

cs-remote-ops-bof

cs-situational-awareness-bof

Situational Awareness commands implemented using Beacon Object Files

cve-2024-1086

Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 99.4% in KernelCTF images.

defender_exclusions-bof

A BOF to determine Windows Defender exclusions.

delegationbof

dragoncastle

A PoC that combines AutodialDLL lateral movement technique and SSP to scrape NTLM hashes from LSASS process.

findobjects-bof

A Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific loaded modules or process handles.

handlekatz_bof

A BOF port of the research of @thefLinkk and @codewhitesec

hashdump

Dump Windows SAM hashes

havocframeworkmodules

Modules used by the Havoc Framework

hiddendesktop

HVNC for Cobalt Strike

hollow

EarlyBird process hollowing technique (BOF) - Spawns a process in a suspended state, inject shellcode, hijack main thread with APC, and execute shellcode

impacket_static_binaries

Standalone binaries for Linux/Windows of Impacket's examples

injectamsibypass

Cobalt Strike BOF - Bypass AMSI in a remote process with code injection.

injectetwbypass

CobaltStrike BOF - Inject ETW Bypass into Remote Process via Syscalls (HellsGate|HalosGate)

inlineexecute-assembly

InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module

kdstab

BOF combination of KillDefender and Backstab

kerbrute

A tool to perform Kerberos pre-auth bruteforcing