몾 Artemis @mixic@nanao.cybtex.fr

CoffeeLdr

CoffeeLdr is a BOF loader. This project can be used for testing Beacon Object files without using the Cobalt Strike framework or can be used to give custom implants a way to execute BOFs that where designed for Cobalt strike. Most of the Beacon Api (fork&run and injection) functions are empty for custom implementations.

https://github.com/Cracked5pider/CoffeeLdr

RDPHijack

Cobalt Strike BOF that uses WinStationConnect API to perform local / remote RDP session hijacking.

https://github.com/netero1010/RDPHijack-BOF

sccmdecryptpoc.cs

SCCM Account Password Decryption PoC by Adam Chester.

https://codeload.github.com/gist/5f497d2725a041922c427c3aaa3b37d1/zip/f3cc19a7a834adc9676983def23f2a1b43221b42

OneDriveExplorer

Command line and GUI based application for reconstructing the folder structure of OneDrive

https://github.com/Beercow/OneDriveExplorer

DFSCoerce

PoC for MS-DFSNM coerce NTLM authentication using NetrDfsRemoveStdRoot method

https://github.com/Wh04m1001/DFSCoerce

CVE-2022-23222 PoC

Linux Kernel eBPF Local Privilege Escalation

⚠️ For educational/research purposes only. Use at your own risk.

https://github.com/tr3ee/CVE-2022-23222

usbsas

A free and open source (GPLv3) tool and framework for securely reading untrusted USB mass storage devices.

https://github.com/cea-sec/usbsas

Ica2Tcp

Ica2Tcp is a tool developed in C allowing to proxy any TCP connection inside a Citrix ICA connection.

https://github.com/synacktiv/ica2tcp

An addition to the original Credential Guard bypass PoC, which consists in patching two global variables in wdigest.dll module loaded by LSASS.

https://github.com/itm4n/Pentest-Windows/tree/main/CredGuardBypassOffsets

A simple PoC for creating false AppLocker hash cache entry for a file.

https://github.com/gtworek/PSBits/blob/master/CopyEAs/SetAppLockerHashCache.c

mitmproxy2swagger

Automatically converting mitmproxy captures to OpenAPI 3.0 specifications.

https://github.com/alufers/mitmproxy2swagger

RITA

Real Intelligence Threat Analytics is a framework for detecting command and control communication through network traffic analysis.

https://github.com/activecm/rita