FUD-UUID-Shellcode

FUD-UUID-Shellcode Introduction Another shellcode injection technique using C++ that attempts to bypass Windows Defender using XOR encryption sorcery and UUID strings madness :. How it works Shellcode generation Firstly, generate a payload in binary format using either Havoc, CobaltStrike or...

webkiller

WebKiller V2 Tool Information Gathering Write With Python. PreView root@kitploit: ██╗ ██╗███████╗██████╗ ██╗ ██╗██╗██╗ ██╗ ███████╗██████╗ ██║ ██║██╔════╝██╔══██╗██║ ██╔╝██║██║ ██║ ██╔════╝██╔══██╗ ██║ █╗ ██║█████╗ ██████╔╝█████╔╝ ██║██║ ██║ █████╗ ██████╔╝ ██║███╗██║██╔══╝ ██╔══██╗██╔═██╗ ██║██║...

concealed_position

Concealed Position Concealed Position is a local privilege escalation attack against Windows using the concept of "Bring Your Own Vulnerability". Specifically, Concealed Position CP uses the as designed package point and print logic in Windows that allows a low privilege user to stage and install...

concealed_position

Скрытая позиция Concealed Position — это атака локального повышения привилегий на Windows, использующая концепцию «Bring Your Own Vulnerability». В частности, Concealed Position CP использует предусмотренную логику пакетной точки и печати в Windows, которая позволяет пользователю с низкими...

spraykatz

Spraykatz Spray love around the world Index...

Python-Rootkit

python-rootkit This is a full undetectable python RAT which can bypass almost all antivirus and open a backdoor inside any windows machine which will establish a reverse https Metasploit connection to your listening machine. ViRu5 life cycle Bypass all anti-virus. Inject a malicius powershell...

CVE-2020-0787-EXP-ALL-WINDOWS-VERSION

CVE-2020-0787-EXP-ALL-WINDOWS-VERSION 면책 조항 저자 poc는 연구 목적으로만 제공됩니다. 독자가 이 poc를 다른 행위에 사용할 경우 작성자와 무관합니다 소개 CVE-2020-0787-EXP는 모든 Windows 버전을 지원합니다...

Windows-2

Windows-2 BlueKeep Vulnerable Lab - CVE-2019-0708 1. Overview This repository contains a deliberately vulnerable Windows lab designed to demonstrate the BlueKeep vulnerability affecting the Remote Desktop Protocol RDP service. BlueKeep is a critical pre-authentication Remote Code Execution RCE...

ZeroLogon-CVE-2020-1472-lab

ZeroLogon-CVE-2020-1472 Объяснение и демонстрация уязвимости ZeroLogon CVE-2020-1472 Цель этой лабораторной работы строго образовательная. Ее выполнение не рекомендуется в производственных средах или в средах, которые вам не принадлежат. Об уязвимости Контекст уязвимости Эта уязвимость позволяет...

fortiscan

Fortiscan CVE-2018-13379 FG-IR-18-384 Exploitation Tool, You can use this tool to check the vulnerability in your FortiGate SSL-VPN. This vulnerability affects the following versions: • FortiOS 6.0 - 6.0.0 to 6.0.4 • FortiOS 5.6 - 5.6.3 to 5.6.7 • FortiOS 5.4 - 5.4.6 to 5.4.12...

manul

Manul Manul is a coverage-guided parallel fuzzer for open-source and black-box binaries on Windows, Linux and macOS beta written in pure Python. Quick Start root@kitploit: pip3 install psutil git clone https://github.com/mxmssh/manul cd manul mkdir in mkdir out echo "AAAAAA" in/test python3...

hidden

Hidden 🇺🇦 Hidden был разработан как решение для задач реверс-инжиниринга и исследований. Это драйвер Windows с пользовательским интерфейсом, который используется для скрытия определённого окружения на вашей машине Windows, например, установленных программ для удалённого выполнения кода напр...

LetsDefend-SOC173-Follina-0-Day-Detected

LetsDefend-SOC173-Follina-0-Day-Detected 보안 경고가 표시되어 FollinaCVE-2022-30190 취약점 탐지를 알리고 있습니다. 악성 Word 문서가 msdt.exe 실행을 트리거하여 호스트 JonasPRD에서 원격 코드 실행 가능성을 시사합니다. 우리의 임무는 경고를 조사하고, 악용을 확인하며, 영향을 평가하고, 완화 조치를 권고하는 것입니다. 사례 세부정보 2022년 6월 2일 15:22에 SOC173 - Follina 0-Day Detected SIEM 규칙 에 의해 트리거된 보안 경...

InjectProc

InjectProc Process injection is a very popular method to hide malicious behavior of code and are heavily used by malware authors. There are several techniques, which are commonly used: DLL injection, process replacement a.k.a process hollowing, hook injection and APC injection. Most of them use...

byeintegrity-uac

ByeIntegrity — Windows UAC 우회 사용자 계정 컨트롤UAC을 우회하여 상승된관리자 권한을 획득하고 높은 무결성 수준에서 모든 프로그램을 실행합니다. 요구 사항 관리자 계정 UAC 알림 수준이 기본값 이하로 설정됨 2021 업데이트 ByeIntegrity를 훨씬 더 빠르고, 가볍고, 안정적으로 업데이트하기로 결정했습니다. 이는 상당한 개편이므로 VS 솔루션에 "ByeIntegrity2021"이라는 새 프로젝트를 만들었습니다. 이는 이 공격의 업데이트된 버전입니다. 물론 원본 버전은 여전히 존재합니다. 새 버전...

CVE-2022-34715-POC

CVE-2022-34715-POC CVE-2022-34715-POC pcap nfssvr.sys 버전 10.0.20348.825 root@kitploit: 0: kd r rax=0000000080000001 rbx=0000000000000000 rcx=ffffde87fe461150 rdx=0000000000000000 rsi=fffff8040811aa50 rdi=0000000000000008 rip=fffff80408067dbb rsp=ffffb400eb3e2630 rbp=ffffb400eb3e26b9...

dfirtriage

dfirtriage Инструмент для сбора цифровых криминалистических данных для реагирования на инциденты в ОС Windows. Как использовать Чтобы запустить, поместите dfirtriage.exe на целевой компьютер или подключенный USB-накопитель и выполните с правами администратора, справка по -h. DFIRTriage v6.0...

dfirtriage

dfirtriage Digital forensic acquisition tool for Windows-based incident response. How to Use To run, drop dfirtriage.exe on the target or connected USB drive and execute with admin rights, -h for help. DFIRTriage v6.0 User's Manual Description This document outlines the functionality and proper u...

TriBell_Edge_SandBox_Escape

TriBellEdgeSandBoxEscape Tribell Edge Sandbox Escape - PoCs of Edge's legacy vulnerabilities BadgeUpdateManager / TileFlyoutUpdateManager / ToastNotificationManager to exploit cross-boundary XmlDocument sharing and escape Edge’s LPAC sandbox CVE-2019-0555. The PoCs trigger the execution of...

gpg_reaper

GPG Reaper TL;DR: Получение/Кража/Восстановление закрытых ключей GPG из кэша/памяти gpg-agent Этот POC демонстрирует метод получения закрытых ключей GPG из памяти gpg-agent в Windows. Обычно это возможно только в течение 10 минут значение --default-cache-ttl. К сожалению, функция housekeeping...