Awesome GitHub RepositoriesOffensive Kernel Drivers

A True Instrumentable Binary Emulation Framework

Blackbone es una colección de herramientas especializadas para escaneo de memoria, inyección de procesos e interfaces de controladores de kernel utilizadas para manipular el entorno de ejecución de Windows. Proporciona un framework para ejecutar código remoto, mapear imágenes ejecutables portátiles y gestionar hilos a través de diferentes límites de procesos. El proyecto incluye un controlador de memoria de kernel para acceder a la memoria del kernel y modificar derechos de manejo para ocultar asignaciones de la detección en modo usuario. También cuenta con una librería para interceptar llamadas a funciones en procesos remotos usando interrupciones de software y puntos de interrupción de hardware. El kit de herramientas cubre capacidades más amplias en la manipulación de memoria virtual, como leer, escribir y asignar memoria en procesos locales o remotos. Además, proporciona utilidades para la búsqueda de patrones de memoria para localizar secuencias de bytes específicas y gestión de módulos para inyectar o expulsar binarios.

This project is a red teaming knowledge base and offensive security playbook designed to simulate adversary behavior. It serves as a comprehensive collection of technical guides and tactics for executing red team operations. The repository provides detailed instructions for Active Directory exploitation, including Kerberos abuse and domain privilege escalation. It covers defense evasion through API unhooking and payload obfuscation, as well as Windows internals research involving the manipulation of kernel objects and system memory. The capability surface extends to network penetration testi

OffensiveRust is a red team toolkit and malware development kit written in Rust. It serves as an evasion framework and post-exploitation library, providing a collection of offensive security primitives and a Windows API wrapper for interacting with low-level system functions and undocumented APIs. The project focuses on bypassing security software through direct system calls, memory obfuscation, and stealthy payload execution. It implements techniques to defeat static binary analysis via compile-time string encryption and payload obfuscation, while avoiding detection using parent process ID s

kdmapper is a kernel driver mapper and loader designed to deploy unsigned binaries into privileged kernel memory. It functions as a manual mapper that resolves imports and relocations to execute unsigned code in a privileged environment. The tool bypasses driver signature enforcement by leveraging vulnerable signed drivers to gain write access to protected kernel memory regions. It includes a kernel offset resolver that parses debug symbol files to identify correct memory addresses across different operating system builds. To maintain stealth, the project implements driver trace obfuscation