This blog contains a very quick and dirty way to disable AMSI in the context of Windows Scripting Host which doesn't require admin privilege...

A pattern for a self-installing Windows service in C# with the unstoppable attributes in C#. - malcomvetter/UnstoppableService

Driver loader for bypassing Windows x64 Driver Signature Enforcement - hfiref0x/TDL

All materials from our Black Hat 2018 "Subverting Sysmon" talk - mattifestation/BHUSA2018_Sysmon

An implementation of PSExec in C#. Contribute to malcomvetter/CSExec development by creating an account on GitHub.

Demo of ADRecon presented on 08th and 12th August at BlackHat USA 2018 Arsenal and DEF CON 26 Demo Labs. https://www.blackhat.com/us-18/arsenal/schedule/index.…

Ps1jacker is a tool for generating COM Hijacking payload. - GitHub - cybercitizen7/Ps1jacker: Ps1jacker is a tool for generating COM Hijacking payload.

Tools for instrumenting Windows Defender's mpengine.dll - 0xAlexei/WindowsDefenderTools

Enumerate usernames on a domain where you have no creds by using SMB Relay with low priv. - skorov/ridrelay

There are a variety of reasons why a pen tester would want to obtain the anti-virus configurations of the system they are targeting. The ability to capture this information remotely can allow a pen tester to customize their actions for the computer they are…

Today me and my partner in crime Giuseppe, are releasing our small research with Windows impersonate privileges. The result is a tool named “Juicy Potato”, which is a kind of sequel of …

A sugared version of RottenPotatoNG, with a bit of juice, i.e. another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM.

How to hide Visual Basic Scripts HTA in other files and generate self playing HTA files without the .hta extension.

During penetration tests, our primary goal is to identify the difference in paths that can be used to obtain the goal(s) as agreed upon with our customers. This often succeeds due to insufficient h…