An open-source, free protector for .NET applications

Run PowerShell with rundll32. Bypass software restrictions.

Local Service to SYSTEM privilege escalation from Windows 7 to Windows 10 / Server 2019

Enumerate missing KBs and suggest exploits for useful Privilege Escalation vulnerabilities

A repository with my notable code snippets for Offensive Security's PEN-300 (OSEP) course.

Also known by Microsoft as Knifecoat 🌶️

Identifies the bytes that Microsoft Defender / AMSI Consumer flags on.

Monitor creation, deletion and changes to LDAP objects live during your pentest or system administration!

Fork of SafetyKatz that dynamically fetches the latest pre-compiled release of Mimikatz directly from gentilkiwi GitHub repo, runtime patches signatures and uses SharpSploit DInvoke to PE-Load into…

Loads any C# binary in mem, patching AMSI + ETW.

Process Injection

Self-developed tools for Lateral Movement/Code Execution

OpSec-safe Powershell runspace from within C# (aka SharpPick) with AMSI, Constrained Language Mode and Script Block Logging disabled at startup

A User Impersonation tool - via Token or Shellcode injection

Red Team oriented C# Simple HTTP & WebDAV Server with Net-NTLM hashes capture functionality

Simple executable generator with encrypted shellcode.

Miscellaneous Tools

C# POC for CVE-2021-26855 aka ProxyLogon, supports the classically semi-interactive web shell as well as shellcode injection

official repo for the AdHuntTool (part of the old RedTeamCSharpScripts repo)

Run Rubeus via Rundll32

C# implementation of the research by @jonaslyk and the drafted PoC from @LloydLabs

AmsiScanBufferBypass using D/Invoke

YouTube/Livestream project for obfuscating C# source code using Roslyn

C# Shellcode Runner to execute shellcode via CreateRemoteThread and SetThreadContext to evade Get-InjectedThread

Port of Invoke-Excel4DCOM

A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA based scripts.

RDPThief donut shellcode inject into mstsc

C# POC code for the SessionEnv dll hijack by utilizing called functions of TSMSISrv.dll

IOXIDResolver from AirBus Security/PingCastle