OUned

OUned Проект OUned — инструмент эксплуатации, автоматизирующий злоупотребление ACL организационных подразделений через манипуляции с gPLink. За подробным объяснением принципа атаки, необходимой настройки, а также использования инструмента вы можете обратиться к соответствующей статье:...

DriverJack

DriverJack はじめに DriverJack は、あまり知られていない NTFS テクニックを悪用して脆弱なドライバーを読み込むように設計されたツールです。これらの手法は、既存のサービスをハイジャックすることでシステム上でのドライバーサービスの登録をバイパスし、さらにドライバー読み込みイベントに表示されるイメージパスもスプーフィングします。脆弱なドライバーの存在をさらに偽装するため、この攻撃はエミュレートされたファイルシステムの読み取り専用バイパスも悪用し、読み込む前にマウントされた ISO 上のドライバーファイルのコンテンツを置き換えます。...

gssapi-abuse

gssapi-abuse gssapi-abuse was released as part of my DEF CON 31 talk. A full write up on the abuse vector can be found here: A Broken Marriage: Abusing Mixed Vendor Kerberos Stacks The tool has two features. The first is the ability to enumerate non Windows hosts that are joined to Active Directo...

GhostKatz

GhostKatz Extract LSASS credentials directly from physical memory by abusing signed vulnerable drivers with physical memory read primitives via MmMapIoSpace, bypassing traditional user-mode detection capabilities. This tool was developed in collaboration between Julian Peña and Eric Esquivel. Thi...

targetedKerberoast

targetedKerberoast targetedKerberoast is a Python script that can, like many others e.g. GetUserSPNs.py, print "kerberoast" hashes for user accounts that have a SPN set. This tool brings the following additional feature: for each user without SPNs, it tries to set one abuse of a write permission ...

cve-2024-26229

cve-2024-26229 Версия на Nim ныне устаревшая уязвимости повышения привилегий Windows, эксплуатирующая CSC. Это предназначено только для образовательных целей; обратитесь к списку патчей, чтобы определить, уязвима ли ваша система/ваша цель...

litespeed-cpanel-cve-2026-54420-fix

CVE-2026-54420 완화 툴킷 CVE-2026-54420 에 대한 방어적 수정, 감사 및 검증 툴킷으로, CloudLinux / CageFS 를 사용하는 공유 호스팅 환경에서 LiteSpeed cPanel 플러그인 에 영향을 미칩니다. ⚠️ 보안 공지 이 저장소는 시스템 관리자, 호스팅 제공자, 방어적 보안 연구 만을 대상으로 합니다. 익스플로잇 코드, 공격 도구 또는 무기화된 개념 증명은 포함되어 있지 않습니다. CVE-2026-54420 정보 CVE-2026-54420는 LiteSpeed cPanel 플러그인 / WH...

CVE-2025-55182-research

CVE-2025-55182 - React Server Components RCE NOTE: Written by AI/Claude https://github.com/ejpir/CVE-2025-55182-bypass TL;DR CVE-2025-55182 is a critical RCE vulnerability in React's Flight Protocol. The attack chains path traversal + fake chunk injection + $B handler abuse to execute...

KRBUACBypass

Background This POC is inspired by James Forshaw @tiraniddo shared at BlackHat USA 2022 titled “ Taking Kerberos To The Next Level ” topic, he shared a Demo of abusing Kerberos tickets to achieve UAC bypass. By adding a KERB-AD-RESTRICTION-ENTRY to the service ticket, but filling in a fake...

AV-EDR-Killer

AV/EDR Killer https://github.com/user-attachments/assets/1eda3340-2af2-4136-b74e-be7a3f4b3924 This project demonstartes how a legit, and signed driver can be weponized to gain kernel level access. 🚨 The vulnerable driver: wsftprm.sys , signed by TPZ SOLUCOES DIGITAIS LTDA, and previously exposed ...

CVE-2015-2291

CVE-2015-2291 1 IQVW32.sys до версии 1.3.1.0 и 2 IQVW64.sys до версии 1.3.1.0 в драйвере диагностики Ethernet для Windows от Intel позволяют локальным пользователям вызвать отказ в обслуживании или, возможно, выполнить произвольный код с привилегиями ядра через специально сформированный вызов IOC...

deep-C

Deep-C Deep-C is an Android Deep Link Exploitation Framework that automatically decompiles APKs, identifies exposed and insecure deep link entry points, validates exploitability using static analysis and optional AI verification , and generates executable adb Proof-of-Concepts PoCs. Deep-C is...

pyGPOAbuse

pyGPOAbuse Filter Additions by D4RKMATT3R DISCLAIMER: This was only tested briefly in a local AD environment I take no responsibility for any unprecedented behavior or malfunctioning, it is provided as-is, for authorized testing only, entirely at your own risk. Now supports filtered targeting of...

imMapper

imMapper Демонстрация того, как можно злоупотребить уязвимым драйвером AmdTools64. Драйвер имеет возможность только чтения/записи памяти в пространстве ядра, а также чтения/записи MSR. Для этого требуются права администратора. Драйвер распространяется через инструмент RGBFusion-2. Восклицательный...

Kerbeus-BOF

Kerbeus-BOF Beacon Object Files for Kerberos abuse. This is an implementation of some important features of the Rubeus project, written in C. The project features integration with the C2 frameworks Cobalt Strike, Havoc, AdaptixC2 and Outflank C2. Ticket requests and renewals asktgt The asktgt...

penglab

Penglab Abus de Google Colab pour le fun et le profit. 🐧 Qu'est-ce que c'est ? Penglab est une configuration prête à installer sur Google Colab pour casser des hashs avec une puissance incroyable, vraiment utile pour les CTFs. Voir les benchmarks ci-dessous. Il installe par défaut : Hashcat John...

Certipy

Certipy - AD CS Attack & Enumeration Toolkit Certipy is a powerful offensive and defensive toolkit for enumerating and abusing Active Directory Certificate Services AD CS. It helps red teamers, penetration testers, and defenders assess AD CS misconfigurations - including full support for...

CVE-2024-32004

Create tmp repo, set uploadpack.allowfilter to true git init tmp git -C tmp config uploadpack.allowfilter 1 Clone evil from tmp repo git clone --filter=blob:none --no-local --no-checkout tmp evil rm -rf tmp Configure remote filter script git -C evil config remote.origin.uploadpack...

MalSCCM

MalSCCM This tool allows you to abuse local or remote SCCM servers to deploy malicious applications to hosts they manage. To use this tool your current process must have admin rights over the SCCM server. Typically deployments of SCCM will either have the management server and the primary server ...

CiscoExploit

CiscoExploit Cisco Scan IP/Port/HostName/Boot/Version https://www.cnblogs.com/k8gege/p/10679491.html CVE-2019-1821 Cisco Prime Infrastructure Remote Code Execution https://srcincite.io/blog/2019/05/17/panic-at-the-cisco-unauthenticated-rce-in-prime-infrastructure.html Cisco SNMP RCE...