Category: Exploitation

macOS payload generator

Mystikal v2.2.13 releases: macOS Initial Access Payload Generator

Mystikal Mystikal is a macOS payload generator integrated with Mythic. Mystikal leverages Mythic scripting to log in and creates the necessary payload for the selected initial access method. Mystikal creates an Apfell or Leviathan payload depending on the chosen initial...

WINspect

AMSI.fail: generates obfuscated PowerShell snippets

AMSI.fail C# Azure Function with an HTTP trigger that generates obfuscated PowerShell snippets that break or disable AMSI for the current process. The snippets are randomly selected from a small pool of techniques/variations before...

Donut

Donut: Generates x86 and x64 position-independent shellcode

Donut is a shellcode generation tool that creates x86 or x64 shellcode payloads from .NET Assemblies. This shellcode may be used to inject the Assembly into arbitrary Windows processes. Given an arbitrary .NET Assembly,...

TikiTorch

TikiTorch: Process Hollowing

TikiTorch was named in homage to CACTUSTORCH by Vincent Yiu. The basic concept of CACTUSTORCH is that it spawns a new process, then uses CreateRemoteThread to run the desired shellcode within that target process. Both the process and...

writing custom backdoor payloads

Defcon 27 writing custom backdoor payloads with C# workshop

Writing custom backdoor payloads with C# This workshop aims to provide attendees hands-on experience on writing custom backdoor payloads using C# for the most common command and control frameworks including Metasploit, Powershell Empire, and...

extract Kerberos ticket

tickey: extract Kerberos tickets from Linux kernel keys

Tickey A tool to extract Kerberos tickets from Linux kernel keys. Based on the paper Kerberos Credential Thievery (GNU/Linux). Install git clone https://github.com/TarlogicSecurity/tickey cd tickey/tickey make CONF=Release After that, binary should be in dist/Release/GNU-Linux/....