Loads any C# binary in mem, patching AMSI and bypassing Windows Defender
Repositories
rmusser01 repositories
SpoolSample -> Responder w/NetNTLM Downgrade -> NetNTLMv1 -> NTLM -> Kerberos Silver Ticket
Cutting-edge web scraping techniques workshop at NICAR 2025
Using DInvoke to patch AMSI.dll in order to bypass AMSI detections triggered when loading .NET tradecraft via Assembly.Load().
Hiding the window from screenshots using the function win32kfull::ChangeWindowTreeProtection
Implant drop-in for EDR testing
NSE script to use with nmap tool.
different ntdll unhooking techniques : unhooking ntdll from disk, from KnownDlls, from suspended process, from remote server (fileless)
Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle to ntdll , and trigger exported APIs from the export table
A tool for generating multiple types of NTLMv2 hash theft files by Jacob Wilkin (Greenwolf)
Collection of Offensive C# Tooling
Open Red Team Bag of Tricks - Red Teaming and Pentesting cheat sheet and trick book
Collection of resources for my preparation to take the OSEE certification.
PowerShell Runspace Post Exploitation Toolkit