Red Teamer & Low-Level Developer. Deep dives into Windows Internals, Kernel Exploitation, Driver Analysis, and Red Team techniques.

Red Teamer & Low-Level Developer. Deep dives into Windows Internals, Kernel Exploitation, Driver Analysis, and Red Team techniques.

Red Teamer & Low-Level Developer. Deep dives into Windows Internals, Kernel Exploitation, Driver Analysis, and Red Team techniques.

Introduction This is the seventh post of a series which regards the development of malicious software. In this series we will explore and try to implement multiple techniques used by malicious applications to execute code, hide from defenses and persist. Today we will talk about “Secure Desktop” on Windows and implement a keylogger.

A catalog of wildcard-based command obfuscation techniques for Linux, macOS, Windows CMD, and PowerShell.

audited Windows 11 local privilege escalation surfaces: MareBackup scheduled task has GenericAll for BUILTIN\Users on a SYSTEM-context task definition, WiFiNetworkManagerTask named pipe trusts client-supplied SID at offset 0x14 on a world-writable pipe, Realtek HD Audio exposes a NULL-DACL named pipe to LocalSystem, KSecDD kernel IOCTL map recovered but sensitive operations gated to protected callers — plus the full surface scan across 20+ attack classes

This blog contains my own research collected from the internet, along with ideas from other blogs and studies. While many parts are written in my own words, the Most sections were copied directly from external sources because they were already very well written and clearly expressed. This blog is mainly for sharing my personal notes and learning journey.

“” is published by Luke Paris in Paradoxis.

The article analyzes advanced techniques used to bypass EDR/XDR systems, showing how attackers combine evasion methods—such as indirect syscalls, ETW tampering, API unhooking, and in-memory execution—to evade detection and extend stealth during attacks.

Most research into Windows Hello focuses on the mechanics in use when authenticating to the local device. As an Entra ID researcher, I’ve always been more interested in how these keys are used to authenticate to the cloud. I’ve given several talks on Windows Hello for Business (WHFB for short) and about the many implementation flaws discovered in the process, most of which were fixed by Microsoft. For this blog I want to focus on a technique that was left as-is since it is more or less a consequence of how WHFB works: the ability to perform single-sign on with the backing cryptographic keys from a user session, without needing the PIN or other information/user presence. We will not just look at how we can utilize this to request Primary Refresh Tokens (PRTs), but also how we can use this to perform device registration by using the WHFB key as a FIDO key/passkey., Most research into Windows Hello focuses on the mechanics in use when authenticating to the local device. As an Entra ID researcher, I’ve always been more interested in how these keys are used to authenticate to the cloud. I’ve given several talks on Windows Hello for Business (WHFB for short) and about the many implementation flaws discovered in the process, most of which were fixed by Microsoft. For this blog I want to focus on a technique that was left as-is since it is more or less a consequence of how WHFB works: the ability to perform single-sign on with the backing cryptographic keys from a user session, without needing the PIN or other information/user presence. We will not just look at how we can utilize this to request Primary Refresh Tokens (PRTs), but also how we can use this to perform device registration by using the WHFB key as a FIDO key/passkey.

This post is about how to install the Sliver C2 framework from BishopFox on a blank Kali Linux server. It is meant as the kickoff post for a series of tutorial posts on how to use Sliver, but targeting beginner users rather than experienced red team veterans. , This post is about how to install the Sliver C2 framework from BishopFox on a blank Kali Linux server. It is meant as the kickoff post for a series of tutorial posts on how to use Sliver, but targeting beginner users rather than experienced red team veterans.

GoExec! A new offensive security tool that focuses on OPSEC for lateral movement operations., GoExec! A new offensive security tool that focuses on OPSEC for lateral movement operations.

BOF exploiting the Visual Studio Installer Elevation Service for SYSTEM LPE and persistence via AppDomainManager hijacking, with native ETW evasion. For Cobalt Strike & Adaptix. - 0xaled/Vipere

Another new coercion primitive with LPE - machine-account NTLM coercion from a non-admin user via Windows Store InstallService plugin resolution experiments - 0xHossam/UnCanny

Cobalt Strike BOF to freeze EDR/AV processes and dump LSASS using WerFaultSecure.exe PPL bypass - 0xsh3llf1r3/ColdWer

A C# based Red Team utility, to execute commands on a remote windows system using SMB/SCCM - 5w0rdfi5h/Torpedo

Spartacus DLL/COM Hijacking Toolkit. Contribute to Accenture/Spartacus development by creating an account on GitHub.

Automated script for obfuscating, rebranding and renaming the Havoc C2 Framework to evade AV/EDR and C2 hunters. - Acucarinho/havoc-obfuscator

Contribute to AmberWolfCyber/NachoMDM development by creating an account on GitHub.

WRAITH — a modern browser-hooking framework (BeEF + blind-XSS successor) for red teams, researchers, and educators. For authorized security testing, research & education only. - Arcanum-Sec/wraith

C2-agnostic BOF collection, categorized by attack chain phase. Designed to be small and modular, allowing for quick execution and automation. - GitHub - atomiczsec/Adrenaline: C2-agnostic BOF collection, categorized by attack chain phase. Designed to be small and modular, allowing for quick execution and automation.

NyxInvoke is a Rust CLI tool for running .NET assemblies, PowerShell, and BOFs with Patchless AMSI and ETW bypass features. with Dual-build support - BlackSnufkin/NyxInvoke

A tool to play with scheduled tasks on Windows, in Rust - BlWasp/PhantomTask

🧙\u200d♂️ Node.js Command & Control for Script-Jacking Vulnerable Electron Applications - boku7/Loki

Contribute to C5Hackr/Phantom development by creating an account on GitHub.

Windows utility that extracts and decrypts saved Chrome passwords using DPAPI and the domain backup key from Active Directory. - Chaelsoo/ChromeDump

reverse shell dropper that tries every interpreter on the target - Chaelsoo/polyshell

PowerShell stager for Sliver C2 that downloads and decrypts beacons in-memory while bypassing AMSI. - Chaelsoo/sliver-psh

🧠 The ultimate resource for finding Beacon Object Files (BOFs). - chryzsh/awesome-bof

UDC2 implementation that provides an ICMP C2 channel - Cobalt-Strike/icmp-udc2

open source port/reimplementation of the Cobalt Strike BOF Loader as is - CodeXTF2/Cobaltstrike_BOFLoader

A Binary Ninja plugin using backward slicing of variables as a driver for static taint analysis - cyber-defence-campus/mole

Morion is a PoC tool to experiment with symbolic execution on real-word (ARMv7) binaries. - cyber-defence-campus/morion

A tool that shows detailed information about named pipes in Windows - cyberark/PipeViewer

Weaponize signed .NET ClickOnce applications for initial access by hijacking a dependency DLL via AppDomainManager injection and loading a C# port of ProxyBlob Agent. - dazzyddos/ClickOnceBlobber

Contribute to django-88/NomadScanner development by creating an account on GitHub.

Permanently disable EDRs as local admin. Contribute to duhirsch/MoveEdr development by creating an account on GitHub.

Beacon Object File for LDAP Queries Through ADWS. Contribute to e-fin/ADWS-BOF development by creating an account on GitHub.

Python implementation of OpenPsPipeJack. Contribute to e-fin/PyPsPipeJack development by creating an account on GitHub.

Local Windows credential extraction. Contribute to epotseluevskaya/RegSecretsCS development by creating an account on GitHub.

Proof of Concept (PoC) implant for creating custom Cobalt Strike Beacons - EricEsquivel/CobaltStrike-Linux-Beacon

A slightly more fun way to disable windows defender + firewall. (through the WSC api) - es3n1n/no-defender

Windows remote execution multitool. Contribute to FalconOpsLLC/goexec development by creating an account on GitHub.

A BOF that runs unmanaged PEs inline . Contribute to fortra/No-Consolation development by creating an account on GitHub.

Intercept Windows Named Pipes communication using Burp or similar HTTP proxy tools - gabriel-sztejnworcel/pipe-intercept

SoaPy is a Proof of Concept (PoC) tool for conducting offensive interaction with Active Directory Web Services (ADWS) from Linux hosts. - gmh5225/SoaPy

Adversary Emulation Framework. Contribute to gsmith257-cyber/better-sliver development by creating an account on GitHub.

Cobalt Strike BOF used to perform privilege escalation by exploiting the SeImpersonate privilege. Based on the original GodPotato PoC by BeichenDream. - incursi0n/GodPotatoBOF

Contribute to ironhulk-0xff/WindowsSentinel development by creating an account on GitHub.

Contribute to ivancabrera02/pyTGTdeleg development by creating an account on GitHub.

Slightly modified Limelighter. Contribute to jthuraisamy/Limelighter development by creating an account on GitHub.

BOF to steal browser cookies & credentials. Contribute to KingOfTheNOPs/cookie-monster development by creating an account on GitHub.

SilentChrome-BOF installs Chromium extension, native messaging, and Isolated Web App profile artifacts - KingOfTheNOPs/SilentChrome-BOF

Block Windows Defender by deny ACL. Contribute to lkarlslund/defender-acl-blocker development by creating an account on GitHub.

Cobalt Strike BOF. Contribute to loland/inlineExecute development by creating an account on GitHub.

Demonstrating 3 persistence layers from a single EXE, that converts itself into proxy DLLs at runtime - Maldev-Academy/3LayersPersistence

Gopacket is a clean Go implementation of Impacket, a library intended for working with network protocols. - mandiant/gopacket

Execute PowerShell code at the antimalware-light protection level. - mattifestation/AntimalwareBlight

TeamServer and Client of Exploration Command and Control Framework - maxDcb/C2TeamServer

Rusty Armory - Beacon Object Files (BOFs) in Rust (Codename: Armory) - memN0ps/armory-rs

BOF to impersonate TrustedInstaller via DISM API trigger and thread impersonation - Meowmycks/trustme

PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS. - mertdas/PrivKit

SOCKS-focused NTLM relay with persistent session packages and a long-lived SessionBank that owns authenticated TCP connections. - mverschu/SOCKSRelayd

Amazing whoami alternatives. Contribute to MzHmO/WhoIsWho development by creating an account on GitHub.

A Ligolo-ng JavaScript agent working inside Chrome & Chromium-based browsers by leveraging Isolated Web Applications. - nicocha30/ligolo-iwa

Contribute to NocteDefensor/SCCMDecryptor-BOF development by creating an account on GitHub.

Contribute to NocteDefensor/SCCMDecryptor-BOF development by creating an account on GitHub.

BOF to run PE in Cobalt Strike Beacon without console creation - NtDallas/BOF_RunPe

Cobalt Strike BOF for beacon/shellcode injection using fork & run technique with Draugr synthetic stack frames - NtDallas/BOF_Spawn

A Cobalt Strike BOF implementation of the SilentHarvest registry dumping technique - Octoberfest7/SilentHarvest_BOF

wmi query command-line utility. Contribute to oiweiwei/wmiq development by creating an account on GitHub.

Blind AV solutions by setting firewall rules to block outgoing connections - otterpwn/bound

Collection of many ldap bofs for domain enumeration and privilege escalation. Created for use with the Adaptix C2. - P0142/LDAP-Bof-Collection

The Network Execution Tool. Contribute to Pennyw0rth/NetExec development by creating an account on GitHub.

A tool to transform Chromium browsers into a C2 Implant - praetorian-inc/ChromeAlone

A tool designed for smuggling interactive command and control traffic through legitimate TURN servers hosted by reputable providers such as Zoom. - praetorian-inc/turnt

Initial Access and Post-Exploitation Tool for AAD and O365 with a browser-based GUI - RedByte1337/GraphSpy

Bypass Credential Guard by patching WDigest.dll using only NTAPI functions - ricardojoserf/NativeBypassCredGuard

Remove API hooks from a Beacon process. Contribute to rsmudge/unhook-bof development by creating an account on GitHub.

CSHARP DCOM Fun. Contribute to rvrsh3ll/SharpCOM development by creating an account on GitHub.

A full interactive remote desktop delivered entirely through SSH and displayed directly in your terminal. - rylena/sshdesk

POC tool for ResetNightmare (CVE-2026-27912). Contribute to Semperis-Community/ResetNightmare development by creating an account on GitHub.

Python alternative to Mimikatz lsadump::dcshadow. Contribute to ShutdownRepo/dcshadow development by creating an account on GitHub.

Contribute to skelsec/evilrdp development by creating an account on GitHub.

Contribute to SmtimesIWndr/gdid-reversal development by creating an account on GitHub.

Posts about different topics. Contribute to sneakerhax/Posts development by creating an account on GitHub.

Pass-the-Passkey Family of Attacks. Contribute to SpecterOps/pass-the-passkey development by creating an account on GitHub.

Contribute to ssteelfactor-oss/Kestrel development by creating an account on GitHub.

Just another EDR killer. Contribute to ThanniKudam/TopazTerminator development by creating an account on GitHub.

Nameless C2 - A C2 with all its components written in Rust - NamelessC2/README.MD at main · trickster0/NamelessC2

FaceDancer is an exploitation tool aimed at creating hijackable, proxy-based DLLs by taking advantage of COM-based system DLL image loading - Tylous/FaceDancer

A modern alternative Web-UI for the Mythic Command and Control Server - Whispergate/Hecate

Step through PE functions or shellcode instruction-by-instruction (amd64) - whokilleddb/emulat3

Cobalt Strike UDC2 implementation that provides an Slack C2 channel - GitHub - WKL-Sec/slack-udc2: Cobalt Strike UDC2 implementation that provides an Slack C2 channel

GitHub is where people build software. More than 150 million people use GitHub to discover, fork, and contribute to over 420 million projects.

The different ways to dump lsass. Contribute to yo-yo-yo-jbo/dumping_lsass development by creating an account on GitHub.

Series of blog posts that share the breadth and depth of Huntress’ experience to assist others in reducing their attack surface, and inhibiting or even obviating cyber attacks.

An introduction to Havoc Professional and Kaine-kit, exploring the advanced features and capabilities that make them lucrative for modern security professionals.

A follow-up on klist.exe: extracting non-zeroed TGT session keys without SeTcbPrivilege, abusing WinRM for in-memory remote dumping, and examining behavior under Credential Guard.

Recently, I presented a talk on the main stage at BSides London 2024 and the topic I chose to present on was in regards to bringing trusted binaries to a system and using them in an adversarial fashion.

Non-Malware and Living-off-the-Land Tactics in Modern Cyber Operations The strategic risk of attackers using your own environment against you Cybersecurity has long been defined by its war against …

Windows Persistence Techniques Introduction After getting initial access, the next obvious step is persistence. If your access dies after a reboot or logout, the whole effort is wasted. In this …

COMouflage: Surrogate Injection Welcome to this new Medium post, in this one we have a great technique used to inject a DLL into the svchost.exe process, masquerading the parent process id. The …

Learn about a reference design for a new Beacon Object Files portable executable concept and helpful features.

Swarmer enables stealthy Windows registry persistence by exploiting mandatory user profiles and the Offline Registry API to bypass EDR detection. Learn how this technique leverages NTUSER.MAN files to modify the registry without triggering standard API monitoring.

While working on varying engagements i have been messing with Microsoft Attack Surface Reduction (ASR) quite a bit, since clients often use it to make the life of adversaries(and red teamers) just a tad harder. While working on these engagements i have compiled some tips and tricks in order to bypass/evade some of the rules that ASR offers. In this post i will dive into what ASR is and some of tips and tricks that i often use to bypass/cheese my way around said rules… So strap in and lets get going with some basic ASR understanding.

This blog post will dive into the world of some of the recently published potato techniques that can lead to more serious risks than "just" local Privilege Escalation.

A deep dive look at dllhost.exe and how it works.

Non-interactive logs aren’t just for token refreshes. You can found a brute-force attack hiding in one.

I’m not sure if the frequency at which I encounter cloud/hybrid joined devices has recently increased or if I was sleeping on this capability for literal years (more likely), but this tradecraft has been a serious crutch on red team operations in the last six months

Two long-standing Windows Explorer vulnerabilities lets attackers execute arbitrary PowerShell commands using crafted folder names, affecting Windows 10 and 11 since 2017.

See how the "There and Back Again" NTLM relay attack coerces outbound auth to compromise Active Directory, plus the defenses that stop it.

Bypassing Elastic EDR to Perform Lateral Movement So, I have just recently started playing around with EDRs. As this would have been my first time testing an EDR, I wanted an open-source EDR …

caveman-bofs

Defensive tools like AVs and EDRs rely on command-line arguments for detecting malicious activity. This post demonstrates how command-line obfuscation, a shell-independent technique that exploits executables’ parsing “flaws”, can bypass such detections. It also introduces ArgFuscator, a new tool that documents obfuscation opportunities and generates obfuscated command lines.

Windows’ primary mechanism for shortcuts, LNK files, is frequently abused by threat actors for payload delivery and persistence. This blog post introduces several new LNK file flaws that, amongst other things, allow attackers to fully spoof an LNK’s target. It also introduces lnk-it-up, a tool suite that can generate such deceptive LNK files, as well as detect anomalous ones.

An Offensive Launchpad for Red Teamers