you can call something like NtAllocateVirtualMemoryEx without ever touching ntdll!
https://github.com/whokilleddb/function-collections/blob/main/winapi_alternatives/NtAllocateMemoryEx/main.c
https://github.com/whokilleddb/hoontr
https://github.com/whokilleddb/function-collections/blob/main/winapi_alternatives/NtAllocateMemoryEx/main.c
https://github.com/whokilleddb/hoontr
GitHub
function-collections/winapi_alternatives/NtAllocateMemoryEx/main.c at main · whokilleddb/function-collections
A collection of PoCs to do common things in unconventional ways - whokilleddb/function-collections
Group Policy Objects manipulation and exploitation framework
https://github.com/synacktiv/GroupPolicyBackdoor
https://github.com/synacktiv/GroupPolicyBackdoor
GitHub
GitHub - synacktiv/GroupPolicyBackdoor: Group Policy Objects manipulation and exploitation framework
Group Policy Objects manipulation and exploitation framework - synacktiv/GroupPolicyBackdoor
Named in homage to pwndrop, pwnlift is a simple dotnet server application for uploading files from a desktop without the use of a C2. Useful if you have a console access to a machine and need to take files offline for analysis (such as Code Integrity Policy files).
https://github.com/rasta-mouse/pwnlift
https://github.com/rasta-mouse/pwnlift
GitHub
GitHub - rasta-mouse/pwnlift: Easy peasy file uploads
Easy peasy file uploads. Contribute to rasta-mouse/pwnlift development by creating an account on GitHub.
Comprehensive Windows Syscall Extraction & Analysis Framework
https://github.com/xaitax/NTSleuth
https://github.com/xaitax/NTSleuth
GitHub
GitHub - xaitax/NTSleuth: Comprehensive Windows Syscall Extraction & Analysis Framework
Comprehensive Windows Syscall Extraction & Analysis Framework - xaitax/NTSleuth
Say hello to Eternal Tux🐧, a 0-click RCE exploit against the Linux kernel from KSMBD N-Days (CVE-2023-52440 & CVE-2023-4130)
https://github.com/BitsByWill/ksmbd-n-day
https://github.com/BitsByWill/ksmbd-n-day
GitHub
GitHub - BitsByWill/ksmbd-n-day: Authenticated 0-click RCE against Linux 6.1.45 for CVE-2023-52440 and CVE-2023-4130
Authenticated 0-click RCE against Linux 6.1.45 for CVE-2023-52440 and CVE-2023-4130 - BitsByWill/ksmbd-n-day
EDR-Freeze is a tool that puts a process of EDR, AntiMalware into a coma state.
https://github.com/TwoSevenOneT/EDR-Freeze
https://github.com/TwoSevenOneT/EDR-Freeze
GitHub
GitHub - TwoSevenOneT/EDR-Freeze: EDR-Freeze is a tool that puts a process of EDR, AntiMalware into a coma state.
EDR-Freeze is a tool that puts a process of EDR, AntiMalware into a coma state. - TwoSevenOneT/EDR-Freeze