# byt3bl33d3r/offensivenim

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/byt3bl33d3r-offensivenim).**

3,033 stars · 365 forks · Nim · bsd-2-clause

## Links

- GitHub: https://github.com/byt3bl33d3r/OffensiveNim
- awesome-repositories: https://awesome-repositories.com/repository/byt3bl33d3r-offensivenim.md

## Description

OffensiveNim is a red teaming framework and post-exploitation toolkit developed in Nim. It provides a collection of low-level primitives and a Windows API wrapper designed for offensive security operations, including malware development and shellcode loading.

The project focuses on evasion and obfuscation through techniques such as API unhooking, direct system calls, and anti-debugging mechanisms. It features diverse payload delivery methods, including reflective binary loading, the execution of .NET assemblies via CLR hosting, and various shellcode injection techniques using fibers, COM objects, and remote process manipulation.

The framework covers a broad range of capabilities including credential and token extraction, system reconnaissance via Active Directory and WMI queries, and data exfiltration using HTTP and DNS tunneling. It also includes tools for privilege escalation testing, security monitoring disablement, and the implementation of symmetric AES-256 encryption for securing payloads.

## Tags

### Part of an Awesome List

- [Red Team Tools](https://awesome-repositories.com/f/awesome-lists/security/red-team-tools.md) — Serves as a full red teaming framework for developing custom offensive binaries and evasion tools.
- [Evasion Tooling](https://awesome-repositories.com/f/awesome-lists/security/evasion-tooling.md) — Provides a comprehensive framework of utilities for bypassing security software through obfuscation and anti-debugging.
- [Evasion and Bypass Tools](https://awesome-repositories.com/f/awesome-lists/security/evasion-and-bypass-tools.md) — Provides a suite of tools to detect and bypass debuggers, sandboxes, and other security analysis environments. ([source](https://github.com/byt3bl33d3r/OffensiveNim/tree/master/src))

### Security & Cryptography

- [Evasion Techniques](https://awesome-repositories.com/f/security-cryptography/intrusion-detection-systems/evasion-techniques.md) — Bypasses endpoint detection and response systems by removing API hooks and using direct system calls.
- [Red Teaming Frameworks](https://awesome-repositories.com/f/security-cryptography/red-teaming-frameworks.md) — Serves as a complete red teaming framework built in Nim for offensive security operations.
- [AMSI Bypasses](https://awesome-repositories.com/f/security-cryptography/amsi-bypasses.md) — Overwrites the AMSI scanning function in memory to prevent the detection of malicious payloads. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/amsi_patch_bin.nim))
- [Hook Removal](https://awesome-repositories.com/f/security-cryptography/edr-deployments/hook-removal.md) — Implements EDR evasion by mapping clean copies of system libraries from disk to overwrite patched memory sections. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/unhookc.nim))
- [Credential Extraction Utilities](https://awesome-repositories.com/f/security-cryptography/identity-access-management/credential-lifecycle-management/credential-security/credential-extraction-utilities.md) — Extracts identity tokens and authentication secrets from running processes or local databases. ([source](https://github.com/byt3bl33d3r/OffensiveNim/tree/master/src))
- [In-Memory Payload Execution](https://awesome-repositories.com/f/security-cryptography/in-memory-payload-execution.md) — Loads and executes shellcode or .NET assemblies directly in memory to avoid disk artifacts.
- [CLR Hosting Loaders](https://awesome-repositories.com/f/security-cryptography/in-memory-payload-execution/clr-hosting-loaders.md) — Loads the .NET Common Language Runtime into unmanaged processes to execute assemblies reflectively.
- [Malware Development Kits](https://awesome-repositories.com/f/security-cryptography/malware-development-kits.md) — Provides low-level primitives and API wrappers specifically tailored for creating stealthy Windows malware.
- [Post-Exploitation Frameworks](https://awesome-repositories.com/f/security-cryptography/post-exploitation-frameworks.md) — Provides a comprehensive set of utilities for gathering system and network data after an initial compromise.
- [Post-Exploitation Toolkits](https://awesome-repositories.com/f/security-cryptography/post-exploitation-toolkits.md) — Ships a set of utilities for gathering data and maintaining access on hosts after initial compromise.
- [Privilege Escalation Techniques](https://awesome-repositories.com/f/security-cryptography/privilege-escalation-techniques.md) — Implements advanced methods for gaining elevated permissions by manipulating process tokens and system services.
- [Reflective Memory Executions](https://awesome-repositories.com/f/security-cryptography/reflective-memory-executions.md) — Maps portable executable sections and fixes import tables to run binaries directly from memory.
- [Security Software Evasion](https://awesome-repositories.com/f/security-cryptography/security-configurations/security-check-bypasses/security-software-evasion.md) — Implements techniques to disable security mechanisms and unhook system libraries to evade antivirus and EDR systems. ([source](https://github.com/byt3bl33d3r/OffensiveNim#readme))
- [Security Interface Disablers](https://awesome-repositories.com/f/security-cryptography/two-factor-authentication/authentication-disabling/security-interface-disablers.md) — Patches system components to disable security scanning interfaces like AMSI. ([source](https://github.com/byt3bl33d3r/OffensiveNim/tree/master/src))
- [Anti-Sandbox Techniques](https://awesome-repositories.com/f/security-cryptography/anti-sandbox-techniques.md) — Checks for network domain membership to identify and avoid execution within security sandbox environments. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/sandbox_domain_check.nim))
- [Browser-Based Data Extraction](https://awesome-repositories.com/f/security-cryptography/browser-based-data-extraction.md) — Reads and decrypts stored cookies from browser databases using local system keys. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/chrome_dump_bin.nim))
- [Data Encryption](https://awesome-repositories.com/f/security-cryptography/data-encryption.md) — Transforms data into ciphertext using AES256-CTR mode and SHA256-derived keys. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/encrypt_decrypt_bin.nim))
- [Data Exfiltration Tools](https://awesome-repositories.com/f/security-cryptography/data-exfiltration-tools.md) — Provides utilities to send stolen information to remote servers via DNS and HTTP protocols. ([source](https://github.com/byt3bl33d3r/OffensiveNim/tree/master/src))
- [Debugger Detection](https://awesome-repositories.com/f/security-cryptography/debugger-detection.md) — Includes mechanisms to detect debuggers using Thread Local Storage callbacks to prevent analysis. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/anti_debug_via_tls.nim))
- [Forensic Artifact Removal](https://awesome-repositories.com/f/security-cryptography/forensic-artifact-removal.md) — Includes a feature to remove the currently running executable from disk to eliminate forensic traces. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/README.md))
- [Hardware Breakpoint Patching](https://awesome-repositories.com/f/security-cryptography/hardware-breakpoint-patching.md) — Intercepts function execution by configuring CPU debug registers to redirect control flow. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/hardware_breakpoints.nim))
- [Script-Based DLL Loaders](https://awesome-repositories.com/f/security-cryptography/in-memory-payload-execution/script-based-dll-loaders.md) — Encodes managed DLLs into scripts that load the binary directly into memory for stealthy execution. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/out_compressed_dll_bin.nim))
- [Scripting Language Executions](https://awesome-repositories.com/f/security-cryptography/in-memory-payload-execution/scripting-language-executions.md) — Implements execution of VBScript and JScript code directly from memory using the IActiveScript interface. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/scriptcontrol_bin.nim))
- [Keystroke Logging](https://awesome-repositories.com/f/security-cryptography/keystroke-logging.md) — Includes a keylogger to record keystrokes for stealing passwords and sensitive data. ([source](https://github.com/byt3bl33d3r/OffensiveNim/tree/master/src))
- [Directory Querying](https://awesome-repositories.com/f/security-cryptography/ldap-services/directory-querying.md) — Retrieves user and object information from a domain controller using LDAP filters. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/ldap_query_bin.nim))
- [Process Sandboxing](https://awesome-repositories.com/f/security-cryptography/process-sandboxing.md) — Implements process isolation by removing token privileges and setting the integrity level to Untrusted. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/sandbox_process_bin.nim))
- [COM Scriptlet Execution](https://awesome-repositories.com/f/security-cryptography/remote-script-execution/com-scriptlet-execution.md) — Fetches scriptlet files from remote URLs and executes them through the system's script component runtime. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/execute_sct_bin.nim))
- [COM Object Payloads](https://awesome-repositories.com/f/security-cryptography/remote-script-execution/com-scriptlet-execution/com-object-payloads.md) — Runs payloads by leveraging system COM objects and script controls to execute code. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/README.md))
- [Runtime Memory Manipulation](https://awesome-repositories.com/f/security-cryptography/runtime-memory-manipulation.md) — Provides capabilities for dumping memory from remote processes and performing live memory manipulation. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/README.md))
- [Security Logging Evasion](https://awesome-repositories.com/f/security-cryptography/security-logging-evasion.md) — Prevents system event logging by overwriting the memory of the event tracing function. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/etw_patch_bin.nim))
- [Symmetric Encryption](https://awesome-repositories.com/f/security-cryptography/symmetric-encryption.md) — Secures payloads and configuration strings using AES-256 symmetric encryption. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/README.md))
- [CTR Mode Implementations](https://awesome-repositories.com/f/security-cryptography/symmetric-encryption/aes-implementations/ctr-mode-implementations.md) — Secures data and payloads using the AES-256 cipher in counter mode for confidentiality.

### DevOps & Infrastructure

- [Indirect Process Execution](https://awesome-repositories.com/f/devops-infrastructure/background-job-processing/os-process-execution/indirect-process-execution.md) — Employs indirect process execution and direct system calls to bypass standard API monitoring. ([source](https://github.com/byt3bl33d3r/OffensiveNim/tree/master/src))

### Operating Systems & Systems Programming

- [Process Injection Payloads](https://awesome-repositories.com/f/operating-systems-systems-programming/assembly-injection-interfaces/shellcode-generators/process-injection-payloads.md) — Provides the ability to allocate executable memory and inject shellcode into the current process. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/dynamic_shellcode_local_inject_bin.nim))
- [Direct System Call Invocations](https://awesome-repositories.com/f/operating-systems-systems-programming/direct-system-call-invocations.md) — Invokes kernel functions directly to bypass user-mode hooks in system libraries for evasion. ([source](https://github.com/byt3bl33d3r/OffensiveNim#readme))
- [Remote Thread Injection](https://awesome-repositories.com/f/operating-systems-systems-programming/remote-thread-injection.md) — Writes binary payloads to a remote process's memory and executes them via remote thread creation. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/shellcode_bin.nim))
- [Resource-Based Shellcode Execution](https://awesome-repositories.com/f/operating-systems-systems-programming/resource-based-shellcode-execution.md) — Provides the capability to load and execute raw binary shellcode extracted from the executable's own resource sections. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/rsrc_section_shellcode.nim))
- [Shellcode Loaders](https://awesome-repositories.com/f/operating-systems-systems-programming/shellcode-loaders.md) — Provides advanced mechanisms for executing arbitrary machine code in memory using fibers and reflective loading.
- [Application Identity Spoofing](https://awesome-repositories.com/f/operating-systems-systems-programming/application-identity-spoofing.md) — Creates suspended processes with fake parent IDs to disguise the execution's identity. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/README.md))
- [UUID-Encoded Shellcode Loading](https://awesome-repositories.com/f/operating-systems-systems-programming/assembly-injection-interfaces/shellcode-generators/executable-to-shellcode-converters/uuid-encoded-shellcode-loading.md) — Converts binary payloads into UUID strings to load them into heap memory via system callbacks. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/uuid_exec_bin.nim))
- [Trampoline-Based Hook Engines](https://awesome-repositories.com/f/operating-systems-systems-programming/binary-instruction-patching/trampoline-based-hook-engines.md) — Implements a jump trampoline mechanism to intercept and redirect target function execution to custom handlers. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/Hook.nim))
- [Binary Memory Dumping](https://awesome-repositories.com/f/operating-systems-systems-programming/binary-memory-dumping.md) — Provides the ability to locate a specific system process and write its full memory contents to a file. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/fork_dump_bin.nim))
- [Inline Assembly Payload Execution](https://awesome-repositories.com/f/operating-systems-systems-programming/inline-assembly-payload-execution.md) — Executes binary shellcode using inline assembly to circumvent memory allocation monitoring. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/shellcode_inline_asm_bin.nim))
- [Android Runtime API Hooking](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/system-calls/api-hooking-utilities/android-runtime-api-hooking.md) — Restores original ntdll bytes by mapping a fresh copy from disk to bypass API hooks. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/unhook.nim))
- [COM Integration](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/system-programming-primitives/system-abstractions/os-specific-integration-modules/windows-system-integrations/com-integration.md) — Leverages the Windows COM object model to execute scripts and perform LDAP queries. ([source](https://github.com/byt3bl33d3r/OffensiveNim#readme))
- [Macro-Based Shellcode Execution](https://awesome-repositories.com/f/operating-systems-systems-programming/macro-based-shellcode-execution.md) — Enables the execution of machine code by leveraging Excel 4.0 macros to perform system-level memory allocation. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/wip/excel_4_com_bin.nim))
- [Native Function Invocations](https://awesome-repositories.com/f/operating-systems-systems-programming/native-function-invocations.md) — Provides capabilities to invoke native operating system functions via foreign interfaces for low-level operations. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/README.md))
- [Process Handle Acquisition](https://awesome-repositories.com/f/operating-systems-systems-programming/process-handle-acquisition.md) — Provides mechanisms to obtain handles to remote processes using specific creation methods to bypass security. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/fork_dump_bin.nim))
- [Process Relationship Spoofing](https://awesome-repositories.com/f/operating-systems-systems-programming/process-relationship-spoofing.md) — Assigns a target process as the parent of a new process to hide the true origin of execution. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/blockdlls_acg_ppid_spoof_bin.nim))
- [Suspended Thread Injection](https://awesome-repositories.com/f/operating-systems-systems-programming/remote-thread-injection/suspended-thread-injection.md) — Writes shellcode into a remote process and executes it by resuming a previously suspended thread. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/suspended_thread_injection.nim))
- [Service Binary Path Hijacking](https://awesome-repositories.com/f/operating-systems-systems-programming/service-binary-path-hijacking.md) — Modifies system service binary paths to run a custom payload before restoring the original path. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/scshell_c_embed_bin.nim))
- [PowerShell](https://awesome-repositories.com/f/operating-systems-systems-programming/terminal-command-line-environments/shells-scripting/powershell.md) — Executes PowerShell commands within a process by leveraging the .NET Common Language Runtime. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/execute_powershell_bin.nim))
- [Thread Environment Block Access](https://awesome-repositories.com/f/operating-systems-systems-programming/thread-environment-block-access.md) — Accesses the TEB address using direct assembly to bypass API monitoring. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/syscalls_bin.nim))
- [Windows API Wrappers](https://awesome-repositories.com/f/operating-systems-systems-programming/windows-api-wrappers.md) — Includes a comprehensive wrapper for the Windows API to simplify low-level process and memory operations.

### Web Development

- [.NET Assembly Loaders](https://awesome-repositories.com/f/web-development/dynamic-loading-strategies/dynamic-stylesheet-loading/reflective-loading-mechanisms/net-assembly-loaders.md) — Executes .NET assemblies directly in memory via the Common Language Runtime to avoid disk persistence. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/execute_assembly_bin.nim))

### Business & Productivity Software

- [VBA Macro Embedding](https://awesome-repositories.com/f/business-productivity-software/vba-macro-embedding.md) — Implements the insertion of VBA macros containing shellcode into Excel workbooks for payload delivery. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/excel_com_bin.nim))

### Development Tools & Productivity

- [Windows DLL Generation](https://awesome-repositories.com/f/development-tools-productivity/command-execution/arbitrary/dll-loading/windows-dll-generation.md) — Builds dynamic link libraries with exported entry points and custom initialization logic. ([source](https://github.com/byt3bl33d3r/OffensiveNim#readme))
- [Privileged Shell Executions](https://awesome-repositories.com/f/development-tools-productivity/shell-command-execution/privileged-shell-executions.md) — Duplicates access tokens from target processes to execute commands with stolen elevated privileges. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/token_steal_cmd.nim))

### Networking & Communication

- [DNS Exfiltration Tools](https://awesome-repositories.com/f/networking-communication/dns-exfiltration-tools.md) — Transmits base64 encoded file contents as DNS TXT record queries to bypass network restrictions. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/dns_exfiltrate.nim))

### Software Engineering & Architecture

- [Shellcode Execution via Fibers](https://awesome-repositories.com/f/software-engineering-architecture/concurrent-task-execution/fiber-based-concurrent-execution/shellcode-execution-via-fibers.md) — Runs machine code in a new fiber to decouple the execution flow from the main process thread. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/shellcode_fiber.nim))
- [Dynamic Library Exports](https://awesome-repositories.com/f/software-engineering-architecture/shared-library-integrations/dynamic-library-exports.md) — Implements the export of internal logic as shared binary libraries to facilitate remote process injection.

### System Administration & Monitoring

- [Command Execution Engines](https://awesome-repositories.com/f/system-administration-monitoring/command-execution-engines.md) — Provides utilities to programmatically run scripts, assembly code, and COM objects to interact with the operating system. ([source](https://github.com/byt3bl33d3r/OffensiveNim/tree/master/src))
- [WMI Data Acquisition](https://awesome-repositories.com/f/system-administration-monitoring/wmi-data-acquisition.md) — Uses Windows Management Instrumentation to retrieve lists of running processes and installed antivirus software. ([source](https://github.com/byt3bl33d3r/OffensiveNim/blob/master/README.md))