Popular repositories Loading

1. SigFlip SigFlip Public

   SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.

   C# 1.1k 193

2. GadgetToJScript GadgetToJScript Public

   A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA based scripts.

   C# 893 161

3. ExecuteAssembly ExecuteAssembly Public

   Load/Inject .NET assemblies by; reusing the host (spawnto) process loaded CLR AppDomainManager, Stomping Loader/.NET assembly PE DOS headers, Unlinking .NET related modules, bypassing ETW+AMSI, avo…

   C++ 548 108

4. NTLMRelay2Self NTLMRelay2Self Public

   An other No-Fix LPE, NTLMRelay2Self over HTTP (Webdav).

   C 396 44

5. NoAmci NoAmci Public

   Using DInvoke to patch AMSI.dll in order to bypass AMSI detections triggered when loading .NET tradecraft via Assembly.Load().

   C# 213 48

6. vba2clr vba2clr Public

   Running .NET from VBA

   VBA 142 20