TheWover

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters

Dynamically invoke arbitrary unmanaged code from managed code without PInvoke.

Blog. Watch the repo to subscribe

A .NET tool for exporting and importing certificates without touching disk.

SharpSploit is a .NET post-exploitation library written in C#

GhostLoader - AppDomainManager - Injection - 攻壳机动队

Simple packer for arbitrary data using only .NET API calls. Produces a unique signature with every usage. Standalone program and library. Algorithm: Data <-> GZip <-> AES-256 <-> Base64.

Library of tools and examples for loading/bootstrapping managed code from unmanaged code in .NET

Uses WMI Event Win32_ModuleLoadTrace to monitor module loading. Provides filters, and detailed data. Has an option to monitor for CLR Injection attacks.

Demos of Donut used in conferences, etc. Mostly for my use, but free for others to use as a reference.

Loads .NET Assembly Via CLR Loader

ps-like .NET Assembly for enumerating processes on the current machine or a remote machine.

Remote Administration Tool For Windows VB.NET

HVNC for C# (from TinyNuke)

MemProcFS (fork that allows reading dumps of the lsass process)

Free beerware-quality code in exchange for beer money (if you are so inclined). ;-)

Enumerate and disable common sources of telemetry used by AV/EDR.

Load PE via XML Attribute

Remote Administration Tool For Windows C#

A simple Linux in-memory .so loader

Loading Assemblies Into Processes, the All Natural Organic way

Evade sysmon and windows event logging

Remote Desktop Protocol .NET Console Application for Authenticated Command Execution

A sophisticated, covert Windows-based credential dumper using C++ and MASM x64.

Dump lsass using only Native APIs by hand-crafting Minidump files (without MinidumpWriteDump!)

DLL and PowerShell script to assist with finding DLL hijacks

A Windows native DLL injection library written in C# that supports several methods of injection.

Extracting Clear Text Passwords from mstsc.exe using API Hooking.

eBook "Bypassing AVS by C#.NET Programming" (Free Chapters only)

Interesting apt report collection and some special ioc express

No description.

My repository to upload drivers from different books and all the information related to windows internals.

Collection of Malware source code by Language and Family.

Pinjectra is a C/C++ OOP-like library that implements Process Injection techniques (with focus on Windows 10 64-bit)

Collection of source code for Polymorphic, Metamorphic, and Permutation Engines used in Malware

No description.

Adaptive DLL hijacking / dynamic export forwarding

DLL Generator for side loading attack

Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources

C# binary that mutates its own code, encrypts and obfuscates itself on runtime

Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the intentions of a process.

:fish: PoC of a VBA macro spawning a process with a spoofed parent and command line.

💉 Tiny 64-bit RunPE written in C# 💉

A lightweight native DLL mapping library that supports mapping directly from memory

The largest, public library of adversary emulation plans in JSON. A place to share custom SCYTHE threats with the community. #ThreatThursday

Windows Package Manager CLI (aka winget)

Small scripts that make life better

Reflective PE loader for DLL injection

Converts PE into a shellcode

Windows process injection methods

Bare template for a Kernel Mode Driver

StandIn is a small .NET35/45 AD post-exploitation toolkit

SharPyShell - tiny and obfuscated ASP.NET webshell for C# web applications

Driver loader for bypassing Windows x64 Driver Signature Enforcement

CLRHosting in C++ with 4.0 - 4.7 .Net Framework Support. Executes a .net application from virtual memory.

Active Directory certificate abuse.

Dynamically Loads Assembly and Calls Methods from JScript

Constrained Language Mode + AMSI bypass all in one

Cobalt Strike Field Manual - A quick reference for Windows commands that can be accessed in a beacon console.

Literally, the perfect injector.

No description.

.NET runtime inspector

Framework for Making Environmental Keyed Payloads (NO LONGER SUPPORTED)

Malware USB Spread | Example C#

Malware sample library.

APT34/OILRIG leak

Shellcoding utilities

Clone a voice in 5 seconds to generate arbitrary speech in real-time

Apache Tomcat 远程代码执行漏洞批量检测脚本(CVE-2025-24813)

Executes Blended Managed/Unmanged Exports

Simple POC library to execute arbitrary calls proxying them via NdrServerCall2 or similar

KrbRelayUp - a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings).

No description.

The Microsoft community Windows Package Manager manifest repository

Original proof of concept I submitted to brokers demonstrating the vulnerability in hopes of getting rid of it.

Targeted Payload Execution

Creates a Win32PE process in the same address space as the host process. ( Executing Process From Memory ) in C++.

Simple Process Hollowing in C#

Seven different DLL injection techniques in one single project.

💉 Two C# RunPE's capable of x86 and x64 injections 💉

Porting of mimikatz sekurlsa::logonpasswords, sekurlsa::ekeys and lsadump::dcsync commands

No description.

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

Collection of source code Libraries which can be utilized by Malware

An AWS Pentesting tool that lets you use one-liner commands to backdoor an AWS account's resources with a rogue AWS account - or share the resources with the entire internet 😈

A helper utility for creating shellcodes. Cleans MASM file generated by MSVC, gives refactoring hints.

Salsa Tools - ShellReverse TCP/UDP/ICMP/DNS/SSL/BINDTCP and AV bypass, AMSI patched

JNDI-Exploitation-Kit（A modified version of the great JNDI-Injection-Exploit created by @welk1n. This tool can be used to start an HTTP Server, RMI Server and LDAP Server to exploit java web apps vulnerable to JNDI Injection）

Execute Native DLL from .NET

Windows memory hacking library

Empire is a PowerShell and Python 3.x post-exploitation framework.

A Virtualization Obfuscation Tool for C# programs

Lateral Movement technique using DCOM and HTA

Write minidumps of .NET processes with full memory, only CLR heaps, or no memory at all

No description.

Dumping processes using the power of kernel space !

Suite of Shellcode Running Utilities

Nishang - Offensive PowerShell for red team, penetration testing and offensive security.

Fileless lateral movement tool that rely on ChangeServiceConfigA to run command

Python Server for PoshC2

Please no pull requests for this repository. Thanks!

No description.

Easily define in-memory enums, structs, and Win32 functions in PowerShell

PowerShell rebuilt in C# for Red Teaming purposes

No description.

External C2 Using IE COM Objects

AMSI bypass stager generator

C# Loader with BlackBone

SharpBox is a C# tool for compressing, encrypting, and exfiltrating data to DropBox using the DropBox API.

Windows System Call Tables (NT/2000/XP/2003/Vista/2008/7/2012/8/10)

Load self-signed drivers without TestSigning or disable DSE

PE reader and editor. Native headers and resources, .NET metadata and disassemblers (x86 and cil).

Simple Dll injector loading from memory. Supports PE header and entry point erasure. Written in C99.

Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers.

Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

Brand New Code Injection for Windows

Go wrapper for the .NET Core Runtime.

PInvoke Interop Assistant

Custom GetProcAddress, GetModuleHandleA and some dbghelp.dll functions

Injects C# EXE or DLL Assembly into every CLR runtime and AppDomain of another process.

No description.

Mindbg is a simple debugger engine written in .net 4.0 for learning purposes.

.NET Core Assembly Loading Samples / Tests

Allow a Go process to dynamically load .NET assemblies

Hacker is a Jekyll theme for GitHub Pages

SharpClipHistory is a .NET application written in C# that can be used to read the contents of a user's clipboard history in Windows 10 starting from the 1809 Build.

embedded-hal implementation for Rust on ESP32 and ESP-IDF

Bindings for ESP-IDF (Espressif's IoT Development Framework)

A suite of services over Citrix, VMware Horizon and native Windows RDP.

Spartacus DLL/COM Hijacking Toolkit

Inject DLL Prototype using Microsoft.Windows.ACTCTX COM Object

Managed wrappers around the Windows API and some Native API

Computer object takeover through Resource-Based Constrained Delegation (msDS-AllowedToActOnBehalfOfOtherIdentity)

x64 manualmapper with kernel elevation and thread hijacking capabilities

Out-of-the-box CobaltStrike Beacon source code use C++

DeepFaceLab is a tool that utilizes machine learning to replace faces in videos. Includes prebuilt ready to work standalone Windows 7,8,10 binary (look readme.md).

A Windows managed function detouring library written in C# that supports both x86 and x64 detours.

.NET DllExport

Compound Actions align with MITRE ATT&CK TTPs at the procedure level.

A place to share SCYTHE modules with the community.

Reflective PE packer.

Executes 64bit code from a 32bit process

Proof of Concept Code For Troopers 2016

OPCDE DXB 2017 + 2018 Materials

No description.

No description.

Methods for attacking KeePass 2.X databases, including extracting of encryption key material from memory.

.NET deobfuscator and unpacker.

Go Operating System

A Threat hunter's playbook to aid the development of techniques and hypothesis for hunting campaigns.

Python Script to access ATT&CK content available in STIX via a public TAXII server

Position Independent Windows Shellcode Written in C

Source code for '.NET IL Assembler' by Serge Lidin

A Bind Shell Using the Fax Service and a DLL Hijack

A CALDERA plugin

PoC to demonstrate how CLR ETW events can be tampered.

subTee gists code backups

A set of scripts that demonstrate how to perform memory injection in C#

Materials for AWS Training

lateral movement techniques that can be used during red team exercises

Windows Local Privilege Escalation from Service Account to System

Host the RDP control in a WPF project

No description.

A more stealthy variant of "DLL hollowing"

https://twitter.com/itsreallynick/status/1120410950430089224

Client/Server scripts to transfer files over DNS. Client scripts are small and only use native tools on the host OS.

OpenNT MinKernel Component

An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR

A set of demos and a PowerShell module to interact with DotNetInterop.

Memory File System written in F# (using WinFsp)

ntoskrnl symbol pdb and undocument structures

Windows Research Kernel

.NET instrumentation framework

The Windows Research Kernel (WRK)

Quick Proof of Concept for reading a processes memory and searching for a specific string.

A small, null-free Windows shellcode that executes calc.exe (x86/x64, all OS/SPs)

A Linux based Windows compatible user mode kernel

Hook system calls, context switches, page faults and more.

Recreation of GetProcAddress without external dependencies on Windows Libraries

Protocol Buffers library for idiomatic .NET

Leaked Muddyc3 C2 source.

userland exec for Linux x86_64

Process reimaging proof of concept code

Virtualization made for .NET using ConfuserEX

Anti-.NET Malware/Packers - Detect most .NET Packers (and some native) used for malware.

LSASS memory dumper using direct system calls and API unhooking.

Tool for injecting a shared object into a Linux process

WMI Event Subscription Persistence in C#

No description.

No description.

Prototype of writing a managed JIT in C# with CoreCLR

No description.

Windows x64 Driver Signature Enforcement Overrider

.NET Micro Framework Interpreter

Javascript Interpreter for .NET

A specialized C# memory-accessing library

DotNext 2019 St. Petersburg Talk Demos

executing JS from x86 code

[ https://vssbe.r-eg.net ] Event-Catcher with variety of advanced Actions to service projects, libraries, the build processes and processes at runtime from Visual Studio and MSBuild Tools.

Binder of Unmanaged native data. An powerful engine for work with unmanaged memory, pe-modules, and their data: Libraries, Executable Modules, other native (C/C++, ...) and binary data ...