rmdavy/AmsiPEBWalkVBA

Stars
20
Rank 1,084,305 (Top 22 %)
Language VBA
License
Apache License 2.0
Created about 4 years ago
Updated almost 2 years ago

rmdavy/AmsiPEBWalkVBA

rmdavy

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Walking the PEB in VBA

HeapsOfFun

AMSI Bypass Via the Heap

AMSI_Ordinal_Bypass

Bypass AMSI and Defender using Ordinal Values

WordAmsiBypass

VBAFunctionPointers

redtest

AmsiPEBWalkVBAx64

hashmatch

Audits AD hashdump and looks for instances for password reuse

badodf

Creates a malicious ODF document help leak NetNTLM Creds

enumprocmodules

Get Amsi Function Addresses Using EnumProcessModules & Half a Peb walk

PasswordAuditor

Password Auditor generates various useful outputs for reporting when conducting a Windows based password Audit

ntlmrelayx-wrap

Wrapper Code for Impacket NTLMRelayX

reads

REsponder Active Database Sifter

nexport

Nessus Parsing Tool

pathchecker

Checks if folders in PATH are writable

qdsp

Quick and Dirty SPN Parser

ipfreely

hash2spray

make spraying a little easier

Kerberoasting

I have created a small C# project that requests a Ticket Granting Service ticket using KerberosSecurityTokenProvider to use for Kerberoasting. I started the project for educational purposes only, but the tool works fine and is not detected by Microsoft Defender for Identity.