SeImpersonate privilege escalation tool for Windows 8 - 11 and Windows Server 2012 - 2022 with extensive PowerShell and .NET reflection support.

generate payloads that force authentication against an attacker machine

Lists who can read any gMSA password blobs and parses them if the current user has access.

Python version of the C# tool for "Shadow Credentials" attacks

BadAssMacros - C# based automated Malicous Macro Generator.

Trying to tame the three-headed dog.

Impacket is a collection of Python classes for working with network protocols.

A little tool to play with Windows security

A Python based ingestor for BloodHound

Six Degrees of Domain Admin

C# Data Collector for BloodHound

This function runs a number of checks on a system to help provide situational awareness to a penetration tester during the reconnaissance phase. It gathers information about the local system, users…

PowerSploit - A PowerShell Post-Exploitation Framework

PowerShell Constrained Language Mode Bypass

A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA based scripts.

A repository with my notable code snippets for Offensive Security's PEN-300 (OSEP) course.

Tool to bypass LSA Protection (aka Protected Process Light)

A tool to create a JScript file which loads a .NET v2 assembly from memory.

Payload Generation Framework

Tool for Active Directory Certificate Services enumeration and abuse

Windows NT x64 Syscall tables

Windows NT x64 syscall fuzzer

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters

RpcView is a free tool to explore and decompile Microsoft RPC interfaces

A fork of AFL for fuzzing Windows binaries

A .net OLE/COM viewer and inspector to merge functionality of OleView and Test Container

Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.

Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user

PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions.

DavRelayUp - a universal no-fix local privilege escalation in domain-joined windows workstations where LDAP signing is not enforced (the default settings).