WEFFLES

WEFFLES WEFFLES is a way to build a fast, free, and effective threat hunting console using Windows Event Forwarding and PowerBI. You can find a full blog post on it at https://aka.ms/weffles but if you're impatient wefsetup.ps1 is the file to start with. Thanks, -Jessica...

Invoke-HiveNightmare

Invoke-HiveNightmare PowerShell-based PoC for CVE-2021-36934, which enables a standard user to be able to retrieve the SAM, Security, and Software Registry hives in Windows 10 version 1809 or newer. Situation In specific versions of Windows 10, standard users have read/execute rights to files in...

ophcrack

OPHCRACK 3.6.0 Time-Memory-Trade-Off-Crack A windows password cracker based on the faster time-memory trade-off using rainbow tables. This is an evolution of the original ophcrack 1.0 developed at EPFL http://lasecwww.epfl.ch/oechslin/projects/ophcrack Ophrack 3.6.0 comes with a Qt Graphical User...

CVE-2023-36424

Information ============== Windows Kernel Pool clfs.sys Corruption Privilege Escalation. CVE-2023-36424 This repo contains technical analysis & working exploit. Author: Nassim Asrir @p1k4l4 || https://www.linkedin.com/in/nassim-asrir-b73a57122/ Vulnerability ================ There is a pool...

CVE-2025-21333

CVE-2025-21333 you can find the first version of exploit for this CVE at https://github.com/MrAle98/CVE-2025-21333-POC/tree/master . I made this new exploit inspired from the one made by MrAle98. It is more stable and little sketchy as it doesn't open windows sandbox process for getting the GUID....

CVE-2025-48799

Description This is PoC for CVE-2025-48799, an elevation of privilege vulnerability in Windows Update service. This vulnability affects windows clients win11/win10 with at least 2 hard drives. When machine have multiple hard drives it is possible to change location where new content is saved usin...

CVE-2025-60710

CVE-2025-60710 This is PoC for local privilege escalation vulnerability in \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration scheduled task. When this scheduled task is started the taskhostw.exe process whill try to open the C:\Users%username%\AppData\Local\CoreAIPlatform.00\UKP directory...

CVE-2023-36874

CVE-2023-36874 Proof of Concept PoC An educational and defensive research implementation of the CVE-2023-36874 vulnerability, demonstrating a Local Privilege Escalation LPE flaw within the Windows Error Reporting WER component. ⚠️ Disclaimer This repository and the provided source code are intende...

ir-rescue

ir-rescue ir-rescue consta de dos scripts hermanos que recopilan una gran cantidad de datos forenses de sistemas Windows de 32 y 64 bits ir-rescue-win y de sistemas Unix ir-rescue-nix. Los scripts respetan el orden de volatilidad y los artefactos que se modifican con la ejecución p. ej. , archivo...

CVE-2024-36991

CVE-2024-36991 POC for CVE-2024-36991: This exploit will attempt to read Splunk /etc/passwd file. Overview This is a bulk scanning and exploitation tool for CVE-2024-36991: Path traversal that affects Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10. This vulnerability was...

0xKern3lCrush

💀 0xKern3lCrush-M4te-CVE-2026-0828 Windows BYOVD Research & Endpoint Recon Notes Strictly educational / security research repository. Goal: Document and understand Bring-Your-Own-Vulnerable-Driver BYOVD techniques via public disclosures — zero working exploits included. This repo collects: Safe...

Reg1c1de

Reg1c1de: Escáner de Elevación de Privilegios del Registro de Windows Resumen de la salida de ayuda: Reg1c1de es una herramienta que escanea colmenas de registro especificadas e informa sobre cualquier clave donde el usuario tenga permisos de escritura. Además, si se encuentran valores de registr...

CVE-2026-41096-POC

the bug is at DnsQueryRaw function to be specific, inside DnsRawTruncateMessageForUdp so you need a program to call it. I could be wrong, but currently there isnt a service or default program in windows 11 that use this function, thats why i needed client.c. this repo has 2 files, client.c and...

winspy

WinSpy winspy : Creador de Backdoor para Reverse Shell de Windows con envenenador de IP Dependencias 1 - metasploit-framework 2 - xterm 3 - apache2 Instalación root@kitploit: sudo apt-get install git git clone https://github.com/TunisianEagles/winspy.git cd winspy chmod +x setup.sh ./setup.sh chm...

GoPurple

GoPurple Este proyecto es una simple colección de diversas técnicas de inyección de shellcode, con el objetivo de agilizar el proceso de evaluación de detección en endpoints, además de desafiarme a mí mismo a adentrarme en el mundo de Golang. Instalación 1 - Requiere go instalado. 2 - Compila la...

CVE-2026-82248

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...

DumpSMBShare

Un script de Python para volcar archivos y carpetas de forma remota desde un recurso compartido SMB de Windows. Características Solo listar recursos compartidos con --list-shares. Seleccionar solo archivos con extensiones dadas con --extensions o todos los archivos. Elegir la carpeta local donde...

spawn

SPAWN - Cobalt Strike BOF Cobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks by spawning sacrificial process with Arbitrary Code Guard ACG, BlockDll, and PPID spoofing. Due to ACG, this does not support shellcode...

CVE-2026-50416-writeup-and-poc

CVE-2026-50416: Un QWORD de más en el montón del escritorio En la compilación Insider de Windows 11 10.0.28020.2149, la asignación en modo usuario del montón del escritorio de Win32k exponía un puntero sin procesar del grupo del kernel de sesión en el desplazamiento 0x100. La lectura en sí es cas...

zer0dump

Zer0Dump Zer0dump es un PoC de exploit/herramienta para abusar de las vulnerabilidades asociadas con CVE-2020-1472 Zerologon con el fin de iniciar una toma de control completa del sistema de un controlador de dominio de Windows sin parchear. Agradecimientos especiales a @dirkjanm y @SecureAuthCor...