HackGit

​​TrevorC2 Command and Control via Legitimate Behavior over HTTP TrevorC2 is a client/server model for masking command and control through a normally browsable website. Detection becomes much harder as time intervals are different and does not use POST requests for data exfil. There are two components to TrevorC2 - the client and the server. The client can be configured to be used with anything. In this example it's coded in Python but can easily be ported to C#, PowerShell, or whatever you want. Currently the trevorc2_client.py supports Windows, MacOS, and Linux. You can always byte compile the Windows one to get an executable, but preference would be to use Windows without having to drop an executable as a stager. https://github.com/trustedsec/trevorc2

​​meterpeter C2 Powershell Command & Control Framework with BuiltIn Commands (Modules) This PS1 starts a listener Server on a Windows|Linux attacker machine and generates oneliner PS reverse shell payloads obfuscated in BXOR with a random secret key and another layer of Characters/Variables Obfuscation to be executed on the victim machine (The payload will also execute AMSI reflection bypass in current session to evade AMSI detection while working). You can also recive the generated oneliner reverse shell connection via netcat. (in this case you will lose the C2 functionalities like screenshot, upload, download files, Keylogger, AdvInfo, PostExploit, etc) meterpeter payloads/droppers can be executed using User or Administrator Privileges depending of the cenario (executing the Client as Administrator will unlock ALL Server Modules, amsi bypasses, etc.). Droppers mimic a fake KB Security Update while in background download\exec Client in '$Env:TMP' trusted location, with the intent of evading Windows Defender Exploit Guard. meterpeter payloads|droppers are FUD (please dont test samples on VirusTotal). Under Linux users required to install powershell and apache2 webserver, Under Windows its optional the install of python3 http.server to deliver payloads under LAN networks. If this requirements are NOT met, then the Client ( Update-KB4524147.ps1 ) will be written in meterpeter working directory for manual deliver. https://github.com/r00t-3xp10it/meterpeter

​​Venom Shellcode generator/compiler/handler (metasploit) https://github.com/r00t-3xp10it/venom

​​HeadMail HeadMail is an cross-platform tool developed using Nodejs which can help investigators and researchers to analyse email headers to filter out relevant data which can be considered useful during digital investigations. Filtered: ▫️ Delivered-To ▫️ From ▫️ Date & Time ▫️ Subject ▫️ Received-SPF ▫️ Content-Type ▫️ Message-ID ▫️ Mime-Version ▫️ X-Mailer https://github.com/umair9747/headmail t.me/hackgit

​​Alfa Network AWUS036ACM The AWUS036ACM is the second adapter that ALFA released with the MediaTek MT7612U as its driver. This chipset is the updated version of the one that was built into the AWUS036ACHM and therefore comes with better performance. Not only has this adapter a small form factor, but it also comes with a dual-antenna setup and you can directly plug it into your laptop. It supports both 2.4 and 5 GHz and it rocks not one but two 5dBi dipole antennas. This allows speeds of up to blazing-fast 867Mbps in 802.11ac and still up to 300Mbps on 802.11n. That is pretty impressive considering how small it is, this goes to show how capable MediaTek's chipsets are. The AWUS036ACM is a newer adapter that I haven't personally tested, but my research shows that it does work very well as a WiFi Adapter for Kali Linux and it is also officially listed in ALFA's list for supported Kali Linux Wireless Adapters. This adapter is very high on my wishlist. Drivers: https://docs.alfa.com.tw/Product/AWUS036ACM/ Buy online: 🛒 https://amzn.to/3rDk4vl #wifi #adapter #alfa

​​Alfa Network AWUS036ACM The AWUS036ACM is the second adapter that ALFA released with the MediaTek MT7612U as its driver. This chipset is the updated version of the one that was built into the AWUS036ACHM and therefore comes with better performance. Not only has this adapter a small form factor, but it also comes with a dual-antenna setup and you can directly plug it into your laptop. It supports both 2.4 and 5 GHz and it rocks not one but two 5dBi dipole antennas. This allows speeds of up to blazing-fast 867Mbps in 802.11ac and still up to 300Mbps on 802.11n. That is pretty impressive considering how small it is, this goes to show how capable MediaTek's chipsets are. The AWUS036ACM is a newer adapter that I haven't personally tested, but my research shows that it does work very well as a WiFi Adapter for Kali Linux and it is also officially listed in ALFA's list for supported Kali Linux Wireless Adapters. This adapter is very high on my wishlist. Repository (drivers): https://github.com/aircrack-ng/rtl8812au Buy online: 🛒 https://amzn.to/3rDk4vl #wifi #adapter #alfa

​​ShellStorm Automatic reverse/bind shell generator cheat sheet. A compilation of knowledge over the years from many pentesters that you will recognize after reading the source code to make the process of creating reverse and bind connections easier for cybersecurity analysts. https://github.com/0bfxgh0st/ShellStorm

​​vba2clr In case anyone wants to run .NET or load .NET assemblies remotely from VBA (No .NET deserialization this time); https://github.com/med0x2e/vba2clr

​​COFF Loader This is a quick and dirty COFF loader (AKA Beacon Object Files). Currently can run un-modified BOF's so it can be used for testing without a CS agent running it. The only exception is that the injection related beacon compatibility functions are just empty. https://github.com/trustedsec/COFFLoader

​​SharpNTLMRawUnHide C# version of NTLMRawUnHide. Based on @mlgualtieri article "Live off the Land and Crack the NTLMSSP Protocol" https://github.com/X-C3LL/SharpNTLMRawUnHide

​​CVE-2021-29156 done right This Proof of Concept is realized because the other PoC publicly available is broken ✨ https://github.com/5amu/CVE-2021-29156 #cve

​​pagodo - Passive Google Dork pagodo automates Google searching for potentially vulnerable web pages and applications on the Internet. It replaces manually performing Google dork searches with a web GUI browser. https://github.com/opsdisk/pagodo

​​Dockerized Android A container-based framework that allows to execute and Android Emulator inside Docker and control it through a browser. This project has been developed in order to provide a starting point for integrating mobile security components into Cyber Ranges but it can be used for any purpose. Anyway, for development and testing purposes the project suggested is docker-android. https://github.com/cybersecsi/dockerized-android

​​OSCP Cheat Sheet Commands, Payloads and Resources for the Offensive Security Certified Professional Certification. https://github.com/0xsyr0/OSCP#gobuster

​​Gofrette A reverse shell payload developed in Golang that bypasses Windows defender (18.2.2022). It also supports network cuts. https://github.com/Enelg52/Gofrette t.me/hackgit

​​PwnBox2 Virtual machines are bloat. Dockerise your CTF environment. Perfect for doing Capture-The-Flag challenges and Pentesting on any platform, without needing a clunky, fat, resource-hungry virtual machine. PwnBox2 provides a wide array of tools at your very own fingertips, powered by Arch Linux! https://github.com/PlatyPew/PwnBox2

​​Arsenal Arsenal is a Simple shell script (Bash) used to install the most important tools and requirements for your environment and save time in installing all these tools. https://github.com/Micro0x00/Arsenal t.me/hackgit

​​UPX Recovery Tool A script that aims to repair the most common modifications done by malware creators to ELF UPX-compressed files done to prevent their automatic unpacking with a standard UPX tool. https://github.com/NozomiNetworks/upx-recovery-tool