624 matches found
OpenPetya
OpenPetya A Proof-of-Concept bootkit and UEFI boot application inspired by Petya ransomware, written in Assembly, C, and C++ If you find this project helpful or informative, I would truly appreciate a ⭐ on the repository. Your support would be a great motivation for me to continue improving this...
Judge-Jury-and-Executable
Judge Jury and Executable A Threat Hunting Forensics Tool Features: Scan a mounted filesystem for threats right away Or gather a system baseline before an incident, for extra threat hunting ability Can be used before, during or after an incident For one to many workstations Scans the MFT, bypassi...
RawCopy
Introduction This a console application that copy files off NTFS volumes by using low level disk reading method. Syntax RawCopy /ImageFile:FullPath\ImageFilename /ImageVolume:1,2...n /FileNamePath:FullPath\Filename /OutputPath:FullPath /AllAttr:0|1 /RawDirMode:0|1|2 /WriteFSInfo:0|1 /TcpSend:0|1...
CVE-2024-0204
CVE-2024-0204: Authentication Bypass in GoAnywhere MFT Script to create a new admin user in GoAnywhere MFT. Blog Post More details here: https://www.horizon3.ai/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive Usage Password must be at least 8 characters long to meet GoAnywhere...
UnderlayCopy
UnderlayCopy UnderlayCopy is a PowerShell utility for low-level NTFS acquisition and dumping protected, locked system artifacts for example: SAM , SYSTEM , NTDS.dit , registry hives , and other files that are normally inaccessible while Windows is running. It supports two complementary modes to...
ntfstool
ntfstool NTFSTool is a forensic tool focused on NTFS volumes. It supports reading partition info MBR, partition table, VBR but also information on Master File Table, Bitlocker encrypted volume, EFS encrypted files, USN journal and more. Download the latest binaries on AppVeyor or by checking the...
RsWindowsThingies
RsWindowsThingies Windows Thingies... but in Rust Tools listenmft Watch an entries' values change. listenmft 0.2.0 Matthew Seyer See the differences in MFT attirbues. USAGE: listenmft.exe OPTIONS FLAGS: -h, --help Prints help information -V, --version Prints version information OPTIONS: -d, --deb...
tscopy
TScopy Updated 2022-03-31 Introducing TScopy It is a requirement during an Incident Response IR engagement to have the ability to analyze files on the filesystem. Sometimes these files are locked by the operating system OS because they are in use, which is particularly frustrating with event logs...
analyzeMFT
AnalyzeMFT Status : All tests passing across Python 3.8-3.12 on Windows, macOS, and Linux. Quick Start Install pip install analyzeMFT Basic usage python analyzeMFT.py -f MFTFILE -o output.csv --csv Generate test MFT for testing python -c "from src.analyzeMFT.testgenerator import createtestmft;...
CVE-2024-0204
CVE-2024-0204: Fortra GoAnywhere MFT Authentication Bypass Deep-Dive This repository contains a proof-of-concept exploit for the authentication bypass vulnerability CVE-2024-0204 discovered in Fortra's GoAnywhere MFT product. The vulnerability allows an unauthenticated attacker to create an...
CVE-2026-90200
A flaw was found in the Linux kernel's NTFS3 file system driver. An integer overflow vulnerability exists in the Multi-File Table MFT cluster validation logic. When processing a specially crafted boot sector, the driver fails to properly validate MFT cluster numbers due to an integer overflow...
CVE-2025-10035
CVE-2025-10035 — Fortra GoAnywhere MFT License Servlet Deserialization RCE Research writeup by Sentinel AI Defense. Defensive analysis only — no working exploit or PoC is published here. A perfect-10 deserialization chain in Fortra GoAnywhere MFT: a forged license response signature lets an...
CVE-2025-10035
CVE-2025-10035 How does this detection method work? Detects vulnerable GoAnywhere MFT instances by extracting version numbers from the login page and matching against affected version ranges. How do I run this script? 1. Download Nuclei from here 2. Copy the template to your local system 3. Run t...
CVE-2025-10035
CVE-2025-10035 Scanner Overview This project provides a tool to scan for systems potentially affected by CVE-2025-10035 , a deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT. The vulnerability may allow an attacker with a validly forged license response signature to...
CVE-2023-0669
CVE-2023-0669 GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. 0x00 Dork shodan title:"GoAnywhere" FOFA title="GoAnywhere" 0x01 Use Java Version java -version openjdk...
CVE-2023-0669
CVE-2023-0669 GoAnywhere MFT Deserialization - Je Yiuwai's Blog CVE-2023-0669 CVE-2023-0669 is a GoAnywhere MFT deserialization vulnerability. Due to the deserialization of an arbitrary attacker-controlled object, a pre-authenticated command injection vulnerability exists in the License Response...
ntfstool
ntfstool NTFSTool es una herramienta forense centrada en volúmenes NTFS. Permite leer información de partición MBR, tabla de particiones, VBR así como información sobre Master File Table, volúmenes cifrados con Bitlocker, archivos cifrados con EFS, diario USN y más. Descarga los últimos binarios ...
fortra-goanywhere-mft-vulnerability-detection
Fortra GoAnywhere MFT Vulnerability Detection Nuclei templates for detecting Fortra GoAnywhere MFT vulnerabilities. Created by@rxerium Overview CVE detection templates for Fortra GoAnywhere Managed File Transfer MFT, including multiple CISA KEV vulnerabilities exploited by ransomware groups...
tscopy
TScopy Actualizado 2022-03-31 Presentando TScopy Durante un compromiso de Respuesta a Incidentes IR, es necesario tener la capacidad de analizar archivos en el sistema de archivos. A veces, estos archivos están bloqueados por el sistema operativo SO porque están en uso, lo que es particularmente...