0xa-saline

using System;
using System.Collections.Generic;
using System.Runtime.InteropServices;
using System.Text;

namespace Hollowing
{
    public class Loader
    {
        public static byte[] target_ = Encoding.ASCII.GetBytes("calc.exe");

0xa-saline

package main

import (
	"io/ioutil"
	"os"
	"os/exec"
	"strconv"
	"syscall"

CCob

#RC4 encryption implementation using Java Crypto API
#Author: @_EthicalChaos_

import javax.crypto.spec.*;
import java.security.*;
import javax.crypto.*;

# $1 = plaintext, $2 = key
sub encryptRC4{

ajpc500

from uuid import UUID
import os
import sys

# Usage: python3 binToUUIDs.py shellcode.bin [--print]

print("""
  ____  _    _______    _    _ _    _ _____ _____       
 |  _ \(_)  |__   __|  | |  | | |  | |_   _|  __ \      
 | |_) |_ _ __ | | ___ | |  | | |  | | | | | |  | |___  

theevilbit

/*
This is a POC for a generic technique I called internally on our red team assessment "Divide and Conquer", which can be used to bypass behavioral based NextGen AV detection. It works by splitting malicious actions and API calls into distinct processes.
*/

#include <stdio.h>
#include <tchar.h>

#include <windows.h>
#include "Commctrl.h"
#include <string>

MHaggis

mubix

function Get-CSharpProcess {
    $proclist = Get-Process
    foreach($proc in $proclist) {
        foreach($mod in $proc.Modules)
        {
            if($mod.ModuleName -imatch "mscoree")
            {
                Write-Output(".NET Found in:`t" + $proc.Name)
            }
        }

rvrsh3ll

using System;
using System.Diagnostics;
using System.IO;
using System.Runtime.InteropServices;

namespace DinjectorWithQUserAPC
{


    public class Program

0xa-saline

using System;
using System.Diagnostics;
using System.IO;
using System.Runtime.InteropServices;

namespace DinjectorWithQUserAPC
{


    public class Program

jfmaes

using System;
using System.Diagnostics;
using System.IO;
using System.Runtime.InteropServices;

namespace DinjectorWithQUserAPC
{


    public class Program