please support me in the future work I will be doing❤️

Updated; version 3.0.0 will be available soon.

ring 0 rootkit created and will be available soon.

modbus fuzzer is updated!
version 3.0.0

2 techniques added to tool
fix and debugged features

The tool was renamed "volt fuzzer" in version 4.0.0.

In version 4.0.0, the tool is capable of scanning and fuzzing vulnerabilities across two protocols (the DNP3 protocol has been added).

More than 10 new techniques have been added in version 4.0.0.

After about two weeks of patching, debugging, and fixing the codes the first version of phoenix_rk is finally being uploaded tonight.

I have now completed and released the rootkit I previously promised to develop.

Next is the deployment file; it has specific execution requirements, but its purpose is to allow you to easily control the rootkit without the hassle of manually launching it. However, for this to work, parts 2 through 6 must be compiled and converted into drivers.

Additionally, all vulnerable drivers must be placed in the drivers folder. This project—phoenix_root—is part of the massive nightfury project 💤.

Instructions:

Vulnerable drivers: RTCore64.sys AsrDrv.sys GLCKIO2.sys

After placing the vulnerable drivers into the drivers folder (located within the compiled driver directory derived from parts 2 through 6), you must compile phoenix_service.c and place the resulting executable file in the same root folder where the deployment file is located.

You may add a client if needed, and you can utilize a C2 (Command & Control) system of your choice.

The Telnet password for the remote control panel is nightfury_admin_2026.

SysPeek یه ابزار خط فرمان ویندوزی برای تحلیل امنیتی و شناسایی تهدیداته

✅ اسکن پروسس‌ها و DLLها با تأیید امضا
✅ شکار LOLBinها و LSASS dumping
✅ تشخیص ردپای باج‌افزار و persistence
✅ اتصالات شبکه به همراه پروسس‌ها
✅ Baseline & Diff برای مشاهده‌ی تغییرات
✅ نظارت لحظه‌ای روی پروسس‌ها و پوشه‌ها
✅ خروجی JSON، CSV و HTML
✅ Threat Score و نگاشت به MITRE ATT&CK

https://github.com/batmanpriv/SysPeek

SysPeek

A blue-team recon & threat-detection toolkit for Windows

SysPeek digs into what's actually running on a Windows host — processes, DLLs, drivers, persistence mechanisms, network connections — and instead of dumping raw data on you, it tells you why something deserves a second look. 🎯

Built for SOC analysts and incident responders who need to walk up to an unfamiliar box and answer "what's really going on here?" in minutes, not hours

Git: https://github.com/batmanpriv/SysPeek

به قول دوستمون با این اوضاع مملکت دیگه نیازی به کلاهبردار نیست ایران فول آپشنه

A new version of the Modbus fuzzer has been released under the new name "Volt Fuzzer"

Addition of several techniques for the Modbus protocol

Addition of the DNP3 protocol to the fuzzer

Automatic protocol detection for a smoother fuzzing process

Support for adding RTU functionality across Windows, Linux, and Android

Use of standard libraries to ensure ease of execution for users

This book is for rootkit development

if you want to develop a rootkit be sure to read it

it is very useful

Tired of ZIP and RAR? Meet maxzip \(^_^)/

It's got 5 compression engines (zstd, xz, brotli, lz4, deflate), picks the best one automatically, removes duplicate data, encrypts with AES-256, and fits in a single file with zero dependencies.

Oh and it actually tests before compressing — no more guessing by file extension.

Check it out: github.com/batmanpriv/maxzip

You should definitely give this tool a try it is truly better than many other tools labeled as compressors

A look at the features and structure of phoenix and how to compile and use it:

Part 1 (related to kernel and bypass):

1.1 UEFI Bootkit Load drivers from ESP before booting Windows

1.2 Disabling Secure Boot Changing UEFI variables to bypass Secure Boot

1.3 Disabling HVCI Patching BCD and Kernel to disable Hypervisor-protected Code Integrity

1.4 Disabling DSE Patching the CiValidateImageHeader and CiGetPolicy functions in the kernel

1.5 Patch Boot Manager Patching bootmgr to bypass Integrity Checks

1.6 Spoof Driver Signature Replacing the driver signature with a Microsoft test signature

1.7 Registering Boot Entry Persistence at the UEFI level by registering a new Boot Option

1.8 Kernel DSE/KPP Bypass Directly patching kernel functions to disable PatchGuard

Part 2 (token manipulation and privilege escalation):

2.1 Token Stealing via DKOM Copying the SYSTEM token to the current process via EPROCESS

2.2 Token Stealing Safe Copy token while preserving RefCount to prevent BSOD

2.3 Token Duplication Create duplicate token with NtDuplicateToken

2.4 Enable All Privileges Enable 15+ Privileges including SeDebug, SeTcb, SeLoadDriver

2.5 CreateProcessWithToken Run process with arbitrary token (e.g. SYSTEM)

2.6 30 Local PE Techniques including Unquoted Path, DLL Hijacking, Scheduled Task, WMI Event, Named Pipe, SAM Copy, LSASS Dump, AlwaysInstallElevated, Print Spooler, CVE-2024-26229, CVE-2025-7771, CVE-2024-30804, CVE-2024-35250 and ...

2.7 30 Domain PE Techniques including Golden Ticket, Silver Ticket, Diamond Ticket, Skeleton Key, AD CS ESC1-ESC8, DCShadow, DCSync, Pass-the-Hash, Pass-the-Ticket, NTLM Relay, LDAP Injection, GPP Decryption and...

Part 3 (hiding and dkom):

3.1 Hide Process Remove process from ActiveProcessLinks with dynamic offset

3.2 Hide Thread Remove thread from ETHREAD list with dynamic offset

3.3 Hide Driver Remove driver from PsLoadedModuleList

3.4 Hide File Hide files via File System Filter

3.5 Hide Registry Key Hide registry keys via Registry Callbacks

3.6 Hide Network Connection Hide network connections

3.7 Patch 70+ Syscalls Patch NtQuerySystemInformation, NtOpenProcess, NtReadVirtualMemory, NtCreateFile, NtCreateKey, NtEnumerateKey and more than 70 other functions

3.8 Patch PspCidTable Hide from Windows Handle Table

3.9 Hide From Csrss Hide from Client/Server Runtime Subsystem

3.10 Hide From Task Manager Hide from Task Manager via patch functions

Part 4 (evasion):

4.1 Remove EDR Callbacks Remove callbacks EDR from PspCreateProcessNotifyRoutine, PspCreateThreadNotifyRoutine, and PspLoadImageNotifyRoutine

4.2 Patch AMSI Patch AmsiScanBuffer and AmsiScanString in amsi.dll

4.3 Patch ETW Patch EtwEventWrite, EtwEventWriteFull, EtwEventWriteString, EtwEventWriteTransfer

4.4 Syscall Hooks Hook 70+ Syscalls for hiding and control

4.5 Call Stack Spoofing Spoof Call Stack with Vectored Exception Handler

4.6 Indirect Syscall Execute Syscall without going to ntdll.dll

4.7 Install VEH Install Vectored Exception Handler for Spoofing

4.8 Enable All Evasion Enable all Evasion techniques at once