Awesome GitHub RepositoriesProcess Injection Payloads

CppGuide is a curated collection of educational resources and practical guides focused on C++ server development, Linux kernel internals, concurrent programming, network protocols, and security exploitation. It provides structured learning paths for backend developers, covering everything from interview preparation to building high-performance network servers and understanding operating system fundamentals. The guide distinguishes itself by offering in-depth, hands-on tutorials that walk through real-world implementations, including building a Redis-like server from scratch, designing custom

Merlin is a cross-platform command and control framework and remote access tool. It provides a server and agent system for post-exploitation coordination, utilizing an HTTP/2 framework for secure communication and the execution of commands across multiple operating systems. The project features an in-memory code execution engine that runs assemblies and shellcode directly within a process to avoid writing files to disk. It implements a decentralized communication architecture through a peer-to-peer network, allowing agents to exchange data via direct bind or reverse connections. To evade det

Donut is a toolset for loading and executing payloads in memory, featuring a position-independent shellcode generator, an in-memory payload injector, and a .NET assembly loader. It is designed to convert executable files and scripts into shellcode that can be executed within the memory space of a remote process without writing files to disk. The project specializes in security evasion through memory-based patching and payload obfuscation using symmetric block ciphers and compression. It includes a remote payload stager to retrieve encrypted modules from HTTP or DNS servers during runtime, red

OffensiveNim is a red teaming framework and post-exploitation toolkit developed in Nim. It provides a collection of low-level primitives and a Windows API wrapper designed for offensive security operations, including malware development and shellcode loading. The project focuses on evasion and obfuscation through techniques such as API unhooking, direct system calls, and anti-debugging mechanisms. It features diverse payload delivery methods, including reflective binary loading, the execution of .NET assemblies via CLR hosting, and various shellcode injection techniques using fibers, COM obje

OffensiveRust is a red team toolkit and malware development kit written in Rust. It serves as an evasion framework and post-exploitation library, providing a collection of offensive security primitives and a Windows API wrapper for interacting with low-level system functions and undocumented APIs. The project focuses on bypassing security software through direct system calls, memory obfuscation, and stealthy payload execution. It implements techniques to defeat static binary analysis via compile-time string encryption and payload obfuscation, while avoiding detection using parent process ID s

Phantom-Evasion es un framework de investigación de seguridad diseñado para generar payloads ofuscados y automatizar tareas de post-explotación durante evaluaciones de seguridad autorizadas. Proporciona un conjunto de utilidades para crear ejecutables y bibliotecas personalizados destinados a probar la eficacia de los sistemas de detección de antivirus y seguridad de endpoints. El framework destaca por su enfoque en operaciones residentes en memoria, permitiendo la ejecución de binarios cifrados y shellcode directamente dentro de la memoria del sistema. Al utilizar técnicas como la inyección de código basura, el cifrado de payloads y la obtención remota de recursos, minimiza la huella forense en una máquina objetivo y evita la dependencia del almacenamiento en disco. Más allá de la generación de payloads, la herramienta incluye capacidades para mantener el acceso al sistema a largo plazo mediante la configuración de claves de registro, tareas programadas y servicios en segundo plano. También admite operaciones sigilosas inyectando shellcode en procesos legítimos del sistema y automatizando tareas administrativas, como la gestión de controladores de registro de seguridad y la memoria de procesos, para facilitar escenarios de pruebas de penetración controladas.