7605 matches found
dcomhijack
DCOM DLL Hijacking We recently discovered the following DCOM classes that are subject to DLL hijacking. If an attacker can write to the associated path, they can move laterally by instantiating the COM object. Some classes have additional DLL hijacking opportunities that are not listed here. Clas...
Criminals turn placeholder domain into ClickFix trap
A domain that has long appeared in software documentation, code examples, and developer test material is now being used to push a ClickFix attack against Windows users. A placeholder domain stands in for a website in an example. The best-known is probably example.com. Another, third-party.com, ha...
thm-ice-icecast-rce-privesc
TryHackMe — Ice: Icecast 2.0.1 RCE & Windows Privilege Escalation Platform: TryHackMe Target OS: Windows 7 / Windows Server 2008 R2 Difficulty: Easy Category: Buffer Overflow RCE, Local Privilege Escalation Summary This report documents the full compromise of the Ice machine on TryHackMe, from...
invoker
Invoker Utilidad de pruebas de penetración y herramienta de evaluación antivirus. Construido con Visual Studio Community 2022 v17.5.4 64 bits y probado en Windows 10 Enterprise OS 64 bits. Hecho con fines educativos. ¡Espero que sea de ayuda! Este repositorio comenzó a tener firmas conocidas y no...
Spartacus
!CAUTION This repo is unmaintained, visit https://github.com/sadreck/Spartacus for the latest version. Spartacus DLL/COM Hijacking Toolkit Why "Spartacus"? If you have seen the film Spartacus from 1960, you will remember the scene where the Romans are asking for Spartacus to give himself up. The...
DataInject-BOF
Data Inject BOF Una implementación en beacon object file de la prueba de concepto de inyección de procesos de mi entrada de blog Control Flow Hijacking via Data Pointers. Secuestra el flujo de control sobrescribiendo los punteros de función de Control Flow Guard de combase.dll que son llamados po...
acCOMplice
acCOMplice Your COM hijacking accomplice Author: David Tulis @kafkaesqu3 Overview This repository contains code samples and proofs-of-concept for exploring COM hijacking. COM hijacking is a Windows post exploitation technique, which can be used for persistence or defense evasion. For more...
DumpChromeSecrets
!IMPORTANT This project is no longer maintained. Please useDumpBrowserSecrets instead, which supports Chrome, Edge, Brave, Firefox, Opera, Opera GX, and Vivaldi. DumpChromeSecrets Extract data from modern Chrome versions, including refresh tokens, cookies, saved credentials, autofill data, browsi...
CVE-2017-0199-Fix
CVE-2017-0199 Fix Remove CVE-2017-0199's ability to execute code by changing the default handler for .hta files. The default handler for files invoked through OLE2 COM Objects is stored separately from the local system's default application and can only be changed through the registry. Basic Logi...
CcmMessagingBackdoor
CcmMessagingBackdoor Herramienta de prueba de concepto para construir e instalar un servicio CcmMessaging rogue para mantener acceso en un Management Point Uso Compilar e instalar el servicio COM rogue en el Management Point Compile PS C:\ C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe...
OWN-Defender
OWN-Defender — Investigación COM del Centro de seguridad de Windows OWN-Defender es un proyecto de investigación de seguridad de Windows centrado en comprender cómo el Centro de seguridad de Windows WSC representa y gestiona los productos de seguridad antivirus a través de sus interfaces COM. El...
CVE-2026-21509-handler
CVE-2026-21509 Office Kill-Bit Manager PowerShell script to check, apply, and test the Kill-Bit protection for the CVE-2026-21509 Microsoft Office zero-day vulnerability affecting Office 2016/2019/LTSC. What is CVE-2026-21509? Critical RCE vulnerability in Microsoft Office OLE/COM handling CVSS...
SCTT-2026-33-0007-The-OLE-Vortex-Laminar-Bypass-
SCTT-2026-33-0007-The-OLE-Vortex-Laminar-Bypass- Microsoft just released emergency patches for CVE-2026-21509, a zero-day in the Office Suite that bypasses OLE/COM mitigations when a user simply opens a file. They think their "Service-side change" for Office 2021+ is a solid wall...
CVE-2026-66804
CVE-2026-66804: Elevación de Privilegios EoP en la Cámara Virtual Cross Device El problema, descubierto e informado de forma independiente, ahora se rastrea como CVE-2026-66804. MSRC confirmó el envío como duplicado de un informe anterior con la misma causa raíz subyacente en Windows Camera...
Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content
The "third-party.com" domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users. "third-party.com has been a generic documentation placeholder for years, the same role example.com plays,"...
CVE-2026-21509
CVE-2026-21509 — Microsoft Office OLE Security-Feature Bypass Research writeup by Sentinel AI Defense. Defensive analysis only — no working exploit or PoC is published here for an actively exploited vulnerability. A security-feature bypass in Microsoft Office that lets a crafted document load COM...
Windows Exploitation Techniques: Dangling COM Object Registrations
Posted by James Forshaw This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. The root cause of the bug wa...
CVE-2026-54676: Missing Authorization
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies does not apply...
