SharpEfsPotato

SharpEfsPotato Escalation locale dei privilegi da SeImpersonatePrivilege tramite EfsRpc. Basato su SweetPotato di @EthicalChaos e SharpSystemTriggers/SharpEfsTrigger di @cube0x0. Utilizzo C:\tempSharpEfsPotato.exe -h SharpEfsPotato by @bugch3ck Local privilege escalation from SeImpersonatePrivile...

TokenMan

Access and Refresh Token Suite. Token Man is a tool for supporting post-exploitation activities using AAD access and/or refresh tokens. Table of Contents Usage Commands Fetch Search Swap FOCI Application Client ID Map AZ OAuth Usage usage: tokenman.py -h fetch,search,swap,az,oauth ... Token Man -...

BOF-pack-1

BOF-pack-1 A care package of useful bofs for red team engagments GetAppLockerPolicy Prints the Effective AppLockerPolicy for the domain TokenElevate Creates a process with winlogon's tokenIncludes Tcb Privilege enabled by default and other winlogon specific privileges. Alternative way to elevate ...

cve-2026-102268-poc

CVE-2026-102268 — PyJWT Asymmetric-PEM Detection Bypass Exploitability analysis result: the root cause is confirmed and end-to-end exploitation is reproducible. A whitespace-mutated PEM public key bypasses PyJWT's ispemformat guard and is accepted as a valid HMAC secret, enabling full HS256 token...

CanaryHunter

Canary Hunter Summary While executing multiple red team engagements over the past few years there have been multiple times where I have run up against Canary Tokens which could potentially alert the SOC to actions taken. As such I spent some time running down the rabbit hole discovering if there...

IntelTXE-PoC

Disclaimer All information is provided for educational purposes only. Follow these instructions at your own risk. Neither the authors nor their employer are responsible for any direct or consequential damage or loss arising from any person or organization acting or failing to act on the basis of...

StopDefender

StopDefender Stop Windows Defender programmatically creating a new token using TrustedInstaller and Windefend service accounts. One button stop action, no need for supply commandline options nor pid. Usefull for integration with Post Explotation frameworks. Blogpost...

impersonate

Impersonate Description This repo contains the toolings that was developped while writing the following blog post https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/. The blog post contains all necesary information to understand how the...

impersonate

Impersonate Beschreibung Dieses Repository enthält die Werkzeuge, die beim Schreiben des folgenden Blogbeitrags https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/ entwickelt wurden. Der Blogbeitrag enthält alle notwendigen Informationen, ...

CVE-2023-45857-Demo

Demo para verificar el comportamiento de la vulnerabilidad CVE-2023-45857 de axios 1. Iniciar en el dev container 2. Ejecutar npm run dev en el contenedor app 3. Acceder a http://app.localhost 4. Comprobar en las herramientas de desarrollo del navegador que la cookie XSRF-TOKEN se ha establecido...

CVE-2024-29868

CVE-2024-29868: Uso di un PRNG crittograficamente debole nella generazione dei token di recupero Questo repository contiene la proof of concept relativa a CVE-2024-29868 che affligge Apache StreamPipes dalla v0.69.0 fino alla 0.93.0. Descrizione : Vulnerabilità di utilizzo di un generatore di...

salt-rce-scanner-CVE-2020-11651-CVE-2020-11652

1 What is it? Scanning tool to test for SaltStack vulnerabilities CVE-2020-11651 & CVE-2020-11652. The vulnerabilities allow an attacker who can connect to the "request server" port to bypass all authentication and authorization controls and publish arbitrary control messages, read and write file...

EXPLOIT-CVE-2026-9198

CVE-2026-9198 — IBM Langflow OSS Unauthenticated RCE Proof-of-concept exploit and a self-contained Docker lab for CVE-2026-9198 , an unauthenticated remote code execution vulnerability in IBM Langflow OSS. The exploit chains two endpoints — autologin which hands out a SUPERUSER token to anyone an...

kernel-mii

Fundación de archivo de objeto Beacon de Cobalt Strike para explotación del kernel mediante CVE-2021-21551. Creado por Tijme. Gracias a Alex por enseñarme. Posibilitado por Northwave Security Descripción Este es un Archivo de Objeto Beacon BOF de Cobalt Strike CS que explota CVE-2021-21551. Solo...

OneDev < 4.0.3 - User Access Token Leak

OneDev before version 4.0.3 contains an insecure endpoint that allows retrieval of arbitrary user details, including access tokens, due to missing security checks on /users/id, letting attackers leak sensitive data and impersonate users, exploit requires no special conditions. id: CVE-2021-21246...

D-Link D-View 8 v2.0.1.28 - Authentication Bypass

Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28 id: CVE-2023-5074 info: name: D-Link D-View 8 v2.0.1.28 - Authentication Bypass author: DhiyaneshDK severity: critical description: | Use of a static key t...

Flowise <= 3.0.5 - Account Takeover

Flowise versions 3.0.5 and earlier had a vulnerability in the forgot-password endpoint, which returned valid reset tokens without authentication—allowing attackers to reset passwords and take over accounts. id: CVE-2025-58434 info: name: Flowise = 3.0.5 - Account Takeover author:...

Discord-Rat

For educational purposes only!! Discord Rat - Setup Guide Author : @deadconvicess | Packaged By: deadconvicess License : MIT WHAT YOU NEED 1. Python 3.11+ Installed 2. A Discord Bot Token https://discord.com/developers/applications 3. A Discord Webhook URL Discord Channel Integrations Webhooks 4...

CVE-2018-0114

CVE-2018-0114 Exploit para Node-jose 0.11.0 escrito en Ruby Uso solo ingresa el nombre de la víctima en el código y ejecuta el archivo con ruby ./exploit.rb Una vulnerabilidad en la librería de código abierto node-jose de Cisco anterior a la versión 0.11.0 podría permitir que un atacante remoto n...

CVE-2024-30804

ASUS Driver LPE PoC Physical Memory Abuse This is a PoC for Local Privilege Escalation LPE that exploits the AsInsHelp64.sys driver. It abuses a legitimate, signed ASUS driver to map physical memory and overwrite kernel tokens, eventually gaining NT AUTHORITY\SYSTEM privileges. 🎯 Vulnerability In...