Defeating Windows User Account Control

Simple tool to configure Windows Filtering Platform (WFP) which can configure network activity on your computer.

WiFi security auditing tools suite

🐛 Access your terminal from anywhere via the web.

eBPF implementation that runs on top of Windows

ENet reliable UDP networking library

Targeted evil twin attacks against WPA2-Enterprise networks. Indirect wireless pivots using hostile portal attacks.

Python interface to the WebRTC Voice Activity Detector

Linux eBPF backdoor over TCP. Spawn reverse shells, RCE, on prior privileged access. Less Honkin, More Tonkin.

tiny, portable SOCKS5 server with very moderate resource usage

Connect like there is no firewall. Securely.

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

HVNC for Cobalt Strike

Collection of PoC and offensive techniques used by the BlackArrow Red Team

Turn off PatchGuard in real time for win7 (7600) ~ later

Cobalt Strike UDRL for memory scanner evasion.

Exploit for 6.4 - 6.5 kernels and another exploit for 5.15 - 6.5

ebpfkit is a rootkit powered by eBPF

An easy-to-use library for emulating memory dumps. Useful for malware analysis (config extraction, unpacking) and dynamic analysis in general (sandboxing).

Tool for extracting information from newly spawned processes

Macro-header for compile-time C obfuscation (tcc, win x86/x64)

The multi-platform memory acquisition tool.

A basic Direct Kernel Object Manipulation rootkit that removes a process from the EPROCESS list, hiding it from the Task Manager

Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

Cobalt Strike HTTPS beaconing over Microsoft Graph API

Simulate the behavior of AV/EDR for malware development training.

A CobaltStrike toolkit to write files produced by Beacon to memory instead of disk

Collection of UAC Bypass Techniques Weaponized as BOFs

PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS.