QuickAssist_UAC_Bypass

QuickAssist UAC Bypass Remark: If you search for a UAC bypass with better compatibility ex: Windows server OSes, you can use:TabTip UAC Bypass QuickAssist is an application that was introduced in Windows 10 1809. It is an UIAccess binary that is installed by default and can be abused to bypass UA...

unhook-bof

This is a Beacon Object File to refresh DLLs and remove their hooks. The code is from Cylance's Universal Unhooking research: https://blogs.blackberry.com/en/2017/02/universal-unhooking-blinding-security-software To use: Load unhook.cna into Cobalt Strike via Cobalt Strike - Script Manager Run...

DirCreate2System

DirCreate2System Weaponizing to get NT AUTHORITY\SYSTEM for Privileged Directory Creation Bugs with Windows Error Reporting Short Description: I've discovered comctl32.dll which is missing in system dir which doesn't really exist has been loaded by wermgr.exe via windows error reporting by runnin...

CVE-2024-50986

CVE-2024-50986: DLL Hijacking Exploit for Clementine Description: An issue in Clementine v.1.3.1 allows a local attacker to execute arbitrary code via a crafted DLL file. Version Affected: Clementine v.1.3.1 Researcher: Utkarsh r1971d3 LinkedIn NIST CVE Link:...

ADModule

ADModule Microsoft signed DLL for the ActiveDirectory PowerShell module Just a backup for the Microsoft's ActiveDirectory PowerShell module from Server 2016 with RSAT and module installed. The DLL is usually found at this path:...

DLLHSC

DLLHSC DLL Hijack SCanner - A tool to generate leads and automate the discovery of candidates for DLL Search Order Hijacking Index of this page Contents of this repository Modes of operation Compile and Run Guidance Help menu Example Runs Feedback Contents of this repository This repository hosts...

Prineo_RE

About PriPara internal name Prineo is an arcade rythm game developed by SynSophia. Goal The goal of this project was to reverse the model format of the arcade series in order to port exclusive characters to the newer version of the game on Nintendo Switch. Screenshots Some interesting screenshots...

gxdlmsdirector-cve

Multiple vulnerabilities in Gurux GXDLMS Director – remote code execution Gurux GXDLMS Director is an open-source Windows program for interacting with energy meters through the use of DLMS/COSEM protocol. The software has a remote update functionality for add-in DLLs as well as for files containi...

TrollDump

TrollDump Injects x64 managed DLL into x64 managed/unmanaged process process must have GUI because we obtain its windows handle using setwindowshook Here as a TROLL, we inject into hidden window taskmgr to do a lsass dump undetected see Test Case section below The injector DLL and injected DLL is...

CVE-2020-0601

CVE-2020-0601 PoC for CVE-2020-0601- Windows CryptoAPI Crypt32.dll POC: https://github.com/ollypwn/CurveBall On kali: 1.Make PKCS12 file openssl req -new -x509 -key spoofedca.key -out spoofedca.crt openssl ecparam -name secp384r1 -genkey -noout -out Microsoft.key openssl req -new -key Microsoft.k...

CVE-2021-40444

Fully Weaponized CVE-2021-40444 Malicious docx generator to exploit CVE-2021-40444 Microsoft Office Word Remote Code Execution, works with arbitrary DLL files. Background Although many PoC are already around the internet, I guessed to give myself a run to weaponizing this vulnerability, as what I...

LdrLockLiberator

LdrLockLiberator For when DLLMain is the only way LdrLockLiberator is a collection of techniques for escaping or otherwise forgoing Loader Lock while executing your code from DllMain or anywhere else the lock may be present. It was released in conjunction with the "Perfect DLL Hijacking" article...

SharpSploitConsole

SharpSploitConsole Console Application designed to interact with SharpSploit released by @cobbrio https://github.com/cobbr/SharpSploit SharpSploit is a tool written by @cobbrio that combines many techniques/C code from the infosec community and combines it into one sweet DLL. It's awesome so chec...

MemoryModulePP

MemoryModulePP memorymodule:https://github.com/fancycode/MemoryModule Library to load a DLL from memory Modify from memorymodule. Support exception...

Monitor

Project Description Used for implementing privilege persistence during the post-exploitation testing phase Project Usage Step 1 : Download the project, then compile Monitor.cpp using VS. Of course, you can also use the pre-compiled one. The Monitor.cpp code is as follows: include "Windows.h" int...

PortBender

Overview PortBender is a TCP port redirection utility that allows a red team operator to redirect inbound traffic destined for one TCP port e.g., 445/TCP to another TCP port e.g., 8445/TCP. PortBender includes an aggressor script that operators can leverage to integrate the tool with Cobalt Strik...

CVE-2019-16784-POC

CVE-2019-16784 POC This is my POC for the Windows PyInstaller version 3.6 vulnerability that exists for the --onefile option. An attacker could achieve command execution and possible LPE by hijacking a DLL imported by the python interpreter DLL used by the pyinstaller binary. A short explanation ...

HelakuruV.1.1-DLLHijack

DLL Hijacking Vulnerability in Helakuru Summary The Helakuru Desktop version 1.1v operates on both 64-bit and 32-bit architectures. During testing, it was identified that the program attempts to load wow64log.dll, which is not included by default in modern Windows operating systems. This results ...

SpoolSploit

SpoolSploit A collection of Windows print spooler exploits containerized with other utilities for practical exploitation. Summary SpoolSploit is a collection of Windows print spooler exploits containerized with other utilities for practical exploitation. A couple of highly effective methods would...

PythonMemoryModule

PythonMemoryModule pure-python implementation of MemoryModule technique to load a dll or unmanaged exe entirely from memory "Python memory module" AI generated pic - hotpot.ai What is it PythonMemoryModule is a Python ctypes porting of the MemoryModule technique originally published by Joachim...