CVE-2025-47962-POC

CVE-2025-47962-POC Reproduction process： i686-w64-mingw32-gcc -shared -o CRYPTBASE.dll poc.c -lkernel32 copy CRYPTBASE.dll "C:\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\CRYPTBASE.dll" net stop IpOverUsbSvc net start IpOverUsbSvc Explanation： IpOverUsbSvc root@kitploit: sc.exe qc IpOverUsbSvc...

CVE-2023-6401

CVE-2023-6401 · DLL Hijacking Proof-of-Concept English | 中文 中文 ⚠️ 重要聲明：僅供安全研究和教育目的使用 NotePad++ ≤ 8.1 DLL劫持漏洞的概念驗證。通過在應用程式目錄放置惡意 dbghelp.dll 來執行任意程式碼。 快速開始 root@kitploit: 下載專案 git clone https://github.com/mekitoci/CVE-2023-6401.git 進入專案目錄 cd CVE-2023-6401-main 編譯DLL gcc -shared -o dbghelp.dll...

CVE-2019-16784-POC

CVE-2019-16784 POC This is my POC for the Windows PyInstaller version 3.6 vulnerability that exists for the --onefile option. An attacker could achieve command execution and possible LPE by hijacking a DLL imported by the python interpreter DLL used by the pyinstaller binary. A short explanation ...

chimera

Rust-based DLL hijacking loader for MobaXterm CVE-2026-6421 with persistence...

CVE-2024-39069

Gestor de Pedidos 'Gestor de Peddios.exe' - Secuestro de DLL Un atacante coloca una DLL maliciosa llamada "d3d12.dll" en un directorio que la aplicación busca antes de encontrar la DLL legítima "d3d12.dll". Cuando se ejecuta la aplicación, carga la DLL maliciosa en lugar de la legítima, permitien...

wptsextensions.dll

WptsExtensions.dll for exploiting Task Scheduler DLL Hijacking "won't fix " Load x64 visual studio environnement variables: root@kitploit: "C:\Program Files x86\Microsoft Visual Studio\2019\Community\VC\Auxiliary\Build\vcvars64.bat" Update the TCHAR script variable with a writable SYSTEM path whe...

CdpSvcLPE

CdpSvcLPE Windows Local Privilege Escalation via CdpSvc service Writeable SYSTEM path Dll Hijacking Short Description: Connected Devices Platform Service or CDPSvc is a service which runs as NT AUTHORITY\LOCAL SERVICE and tries to load the missing cdpsgshims.dll DLL on startup with a call to...

IDiagnosticProfileUAC

IDiagnosticProfileUAC Just another UAC bypass using auto-elevated COM object Virtual Factory for DiagCpl 12C21EA7-2EB8-4B55-9249-AC243DA8C666. This COM object can be used to create instance of DiagnosticProfile D0B7E02C-E1A3-11DC-81FF-001185AE5E76 COM object which exposes SaveDirectoryAsCab metho...

Zoom-dll-hijacking

Zoom-dll-hijacking A dll hijacking vulnerability in zoom meeting 5.1.3 Affected Windows version Windows 7 or less Windows Server 2008 Any other windows system that doesn't have SHCore.dll present. Usage Copy the dbghelper.dll and SHCore.dll to following location...

CVE-2025-33053_PoC

CVE-2025-33053 POC Exploit Overview The working directory in a .url file can be set to a foreign WebDAV server. When opened by a Windows client, dependencies for the executable defined in the URL field are searched for in the foreign WebDAV share. If an arbitrary executable or DLL is given the sa...

RansomLord

RansomLord NG v1.0 Anti-Ransomware exploit tool. Proof-of-concept tool that automates the creation of PE files, used to exploit ransomware pre-encryption. Updated version NG: https://github.com/malvuln/RansomLord/releases/tag/v1.0 Lang: C SHA256:...

CVE-2025-56383

Vulnerability root@kitploit: Attack Type: DLL Hijacking DLL Hijacking Target Application: Notepad++ Method: The NppExport.dll file is loaded by Notepad++ from the working directory Implementation The malicious DLL contains: root@kitploit: Exported functions of the original library to ensure...

CVE-2010-5230

CVE-2010-5230 Multiple untrusted search path vulnerabilities in MicroStation 7.1 allow local users to gain privileges via a Trojan horse 1 mptools.dll, 2 baseman.dll, 3 wintab32.dll, or 4 wintab.dll file in the current working directory, as demonstrated by a directory that contains a .hln or .rdl...

CVE-2025-9435

ADManager Plus Build 7230 Elevation of Privilege CVE-2025-9435 Requirements A technician user with the 'Modify user general properties' role and logon access to the server where ADManager is installed. Description If the technician user has logon rights on the server , they can escalate privilege...

iCUE_DllHijack_LPE-CVE-2024-22002

Vulnerable software and version Software download link: CORSAIR iCUE v5.9.105 with iCUE Murals Description A DLL Hijacking vulnerability has been identified in iCUE v5.9.105. This vulnerability occurs during the update process, managed by the "iCUEUpdateService" service. The service spawns a...

siofra

Summary Siofra is a tool designed to identify and exploit DLL hijacking vulnerabilities in Windows programs. It is able to simulate the Windows loader in order to give visibility into all of the dependencies and corresponding vulnerabilities of a PE on disk, or alternatively an image file in memo...

CVE-2024-34329

CVE-2024-34329 Tested Product: Datacard XPS Card Printer Driver Version: = 8.4 Description: The application is prone to Local Privilege Escalation LPE vulnerability due to insecure file/folder permissions on its default installation, by which it grants the rights for everyone for full control ove...

CVE-2024-34474

CVE-2024-34474 Clario through 2024-04-11 for Windows Desktop has weak permissions for %PROGRAMDATA%\Clario and tries to load DLLs from there as SYSTEM. Description: Clario for Windows desktop application attempts to load non existent DLLs libraries from C:\ProgramData\Clario\ and...

DirCreate2System

DirCreate2System Weaponizing to get NT AUTHORITY\SYSTEM for Privileged Directory Creation Bugs with Windows Error Reporting Short Description: I've discovered comctl32.dll which is missing in system dir which doesn't really exist has been loaded by wermgr.exe via windows error reporting by runnin...

Lockbit3.0-MpClient-Defender-PoC

Lockbit3.0-MpClient-Defender-PoC Lockbit3.0 Microsoft Defender MpClient.dll DLL Hijacking PoC Based on: LockBit ransomware abuses Windows Defender to load Cobalt Strike https://www.bleepingcomputer.com/news/security/lockbit-ransomware-abuses-windows-defender-to-load-cobalt-strike/ How to test by...