reveng007/reveng_loader

Stars
14
Rank 1,438,076 (Top 29 %)
Language
C#
License
MIT License
Created about 2 years ago
Updated almost 2 years ago

reveng007/reveng_loader

reveng007

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

C# loader capable of running stage-1 from remote url, file path as well as file share

DarkWidow

Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird + Spawns a sacrificial Process as target process + (ACG+BlockDll) mitigation policy on spawned process + PPID spoofing + Api resolving from TIB + API hashing

SharpGmailC2

Our Friendly Gmail will act as Server and implant will exfiltrate data via smtp and will read commands from C2 (Gmail) via imap protocol

Learning-EDR-and-EDR_Evasion

I will be uploading all the codes which I created with the help either opensource projects or blogs. This is a step by step EDR learning path for me.

reveng_rtkit

Linux Loadable Kernel Module (LKM) based rootkit (ring-0), capable of hiding itself, processes/implants, rmmod proof, has ability to bypass infamous rkhunter antirootkit.

ReflectiveNtdll

A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (using pe2shc by @hasherezade). Payload encryption via SystemFucntion033 NtApi and No new thread via Fiber

CheckHooks-n-load

A Windows stager-cum-PELoader focusing Dynamic EDR Evasion, as well as FUD till now (24/02/23), when Operator wants to Know the the Underlying functions Hooks and then craft Implant based on the previous condition.

AMSI-patches-learned-till-now

I have documented all of the AMSI patches that I learned till now

C2_Server

C2 server to connect to a victim machine via reverse shell

DareDevil

Stealthy Loader-cum-dropper/stage-1/stager targeting Windows10

ETW_patches_from_userMode_learned_till_now

ETW patches from userMode learned till now

Executable_Files

Database for custom made as well as publicly available stage-2 or beacons or stageless payloads, used by loaders/stage-1/stagers, or for further usage of C2 as well

GDB-Cheat-Sheet

VulnCon-WorkShop-Slides

VulnCon WorkShop - Maldev Workshop : Offensive TradeCraft - Syscalls to Stack Spoofing

RemoveFalsePositives

Just a small python script which spits out unsigned char representation for Hooked Underlying Ntapis (Which are False Positives) , for c/cpp Usage

TryHackMe

THM Walkthroughs

HTB

SSH_Bruter

Bruteforces ssh creds.

Simple_Port_Scanner

Scans Single port as well as Multiple Ports

C-for-Everyone-Programming-Fundamentals

All the topics and concepts of C programming that I have learned so far. The things covered in this repo are all beginner-friendly.

reveng007

reveng007.github.io