techthupport Goto Github PK

aggressivegadgettojscript

A Cobalt Strike Aggressor script to generate GadgetToJScript payloads

alternativeshellcodeexec

Alternative Shellcode Execution Via Callbacks

amsi-killer

Lifetime AMSI bypass

assemblyloader

Loads .NET Assembly Via CLR Loader

asynctools

Various asynchronous tools for Nim language

azure-red-team

Azure Security Resources and Notes

bitmancer

Nim Library for Offensive Security Development

bof-cobaltstrike

Useful Cobalt Strike Beacon Object Files (BOFs) used during red teaming and penetration testing engagements.

bookwin-browser

cheesetools

Self-developed tools for Lateral Movement/Code Execution

conti_locker

Conti Locker source code

cve-2022-22972

deimosc2

DeimosC2 is a Golang command and control framework for post-exploitation.

dinvoke_rs

Dynamically invoke arbitrary unmanaged code.

dumpthatlsass

Dumping LSASS by Unhooking MiniDumpWriteDump by getting a fresh DbgHelp.dll copy from the disk , plus functions and strings obfuscation , it contains Anti-sandbox , if you run it under unperformant Virtual Machine you need to uncomment the code related to it and recompile.

duplicacy-fastcdc

This repo is based on duplicacy, and we implement the FastCDC algorithm instead of original split method.

easyhook

EasyHook - The reinvention of Windows API Hooking

edrsandblast

filelessremotepe

Loading Fileless Remote PE from URI to memory with argument passing and ETW patching and NTDLL unhooking and No New Thread technique

futhark

Automatic wrapping of C headers in Nim

getsystem

This is a C# implementation of making a process/executable run as NT AUTHORITY/SYSTEM. This is achieved through parent ID spoofing of almost any SYSTEM process.

githubc2

Abusing Github API to host our C2 traffic, usefull for bypassing blocking firewall rules if github is in the target white list , and in case you don't have C2 infrastructure , now you have a free one

hellsgatenim

A quick example of the Hells Gate technique in Nim

hvnc

HVNC hidden remote VNC desktop with filemanager and backconnect

hwsyscalls

HWSyscalls is a new method to execute indirect syscalls using HWBP, HalosGate and a synthetic trampoline on kernel32 with HWBP.

idiagnosticprofileuac

inject-assembly

Inject .NET assemblies into an existing process

ligolo-ng

An advanced, yet simple, tunneling/pivoting tool that uses a TUN interface.

logoncredentialssteal

LOCAL AND REMOTE HOOK msv1_0!SpAcceptCredentials from LSASS.exe and DUMP DOMAIN/LOGIN/PASSWORD IN CLEARTEXT to text file.

lsasspotato