Language Breakdown
Lines of code distribution across 15 owned repositories
I-Shaped Developer
I-shapedSpecialist — deep expertise in C
Collaboration Network
Global Impact visualization
Repos
38
PRs
0
Growth
+18%
Top Collaborators
No collaborator data yet.
Coding Streak
Contribution activity over the past year
Jean-François Maes
@jfmaes
RedTeams
@RedTeams
midnite_runr
@secretsquirrel
Ceri Coburn
@CCob
S3cur3Th1sSh1t
@S3cur3Th1sSh1t
Top Repositories
Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".
This are different types of download cradles which should be an inspiration to play and create new download cradles to bypass AV/EPP/EDR in context of download cradle detections.
This POC gives you the possibility to compile a .exe to completely avoid statically detection by AV/EPP/EDR of your C2-shellcode and download and execute your C2-shellcode which is hosted on your (C2)-webserver.
The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls
Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).
Educational proof-of-concept demonstrating DEP/NX bypass using hardware breakpoints, vectored exception handling, and instruction emulation on Windows x64. For security research and learning purposes only.
Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged
This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for local privilege escalation in the context of an unquoted service path, etc. The payload itself can be remotely hosted, downloaded via the wininet library and then executed via direct system calls.
Cobalt Strike Aggressor Script for identifying security products on Windows hosts — six enumeration methods rated by noise level, from silent in-process BOF to full PowerShell/WMI.
This POC provides the possibilty to execute x86 shellcode in form of a .bin file based on x86 inline assembly
Open Source Impact
Contributions to external projects
No external contributions found.