K̵i̵r̵k̵ ̵T̵r̵y̵c̵h̵e̵l̵
@Teach2Breach
MALicious softWARE
github.com/Teach2Breach/s… Locate function addresses in loaded dlls without walking PEB structures or parsing EAT.
how did you get the recording of my defcon talks?
Updated both branches of github.com/Teach2Breach/m… Cleaned up main branch library so its op ready and made reliability improvements on opsec branch. If you have been experimenting with moonwalk, please pull latest update.
Introducing Havoc Professional: A Lethal Presence We’re excited to share a first look at Havoc Professional, a next-generation, highly modular Command and Control framework, and Kaine-kit our fully Position Independent Code agent engineered for stealth! infinitycurve.org/blog/introduct…
Introducing Havoc Professional: A Lethal Presence We’re excited to share a first look at Havoc Professional, a next-generation, highly modular Command and Control framework, and Kaine-kit our fully Position Independent Code agent engineered for stealth! infinitycurve.org/blog/introduct…
P.S. LAMERS, I own 3 Flipper Zeros (you probably don't know what that is) I hide them in my ass so the FBI can't stop me from changing display LEDs at the anime store. It's not weird, it's my secret hiding spot P.S.S. I built my own computer. Got a problem with that, lamer?
Just a friendly reminder that you OpSec sucks. Mine does too, of course, and mine might even be worse than yours.
"how do i learn maldev?" go insane. when other ppl sleep, you read windows api index. you just read it. you crawl @vxunderground and @github for gems in the rough. deep dive some process you never noticed before. you know its illegal and for nerds, but you're simply compelled
Beacon Object Files – Five Years On… 🔥 aff-wg.org/2025/06/26/bea…
"The new Windows capabilities will allow them to start building their solutions to run outside the Windows kernel. This means security products like anti-virus and endpoint protection solutions can run in user mode just as apps do." 👀 blogs.windows.com/windowsexperie…
After today’s talk at #TROOPERS25 I’m releasing BitlockMove, a PoC to execute code on remote systems in the context of a loggedon user session 🔥 github.com/rtecCyberSec/B… No need to steal credentials, no impersonation, no injection needed 👌
🔧 Byont: (PoC) Load clean ntdll.dll from Microsoft symbol servers and execute functions from memory. Manual PE loading without LoadLibrary - bypass userland hooks for security research. github.com/Teach2Breach/b…
🔧 NT Unhooker - (PoC) A Windows security tool that detects & removes inline/IAT hooks from NTDLL.dll github.com/Teach2Breach/n…
