Red-Teaming-Toolkit

Red Teaming Toolkit This repository contains cutting-edge open-source security tools OST that will help you during adversary simulation and as information intended for threat hunter can make detection and prevention control easier. The list of tools below that could be potentially misused by thre...

Active-Directory-Exploitation-Cheat-Sheet

Active Directory Exploitation Cheat Sheet This cheat sheet contains common enumeration and attack methods for Windows Active Directory. ℹ️ This repository was created by Nikos Katsiopis and Nikos Vourdas. This cheat sheet is inspired by the PayloadAllTheThings repo. Summary Active Directory...

pax

pax Exploit padding oracles for fun and profit! Pax PAdding oracle eXploiter is a tool for exploiting padding oracles in order to: 1. Obtain plaintext for a given piece of CBC encrypted data. 2. Obtain encrypted bytes for a given piece of plaintext, using the unknown encryption algorithm used by...

zerologon

ZeroLogon exploitation script Exploit code based on https://www.secura.com/blog/zero-logon and https://github.com/SecuraBV/CVE-2020-1472. Original research and scanner by Secura, modifications by RiskSense Inc. To exploit, clear out any previous Impacket installs you have and install Impacket fro...

pacu

Quick reference Where to get help : the Rhino Security Labs Discord, or Stack Overflow Where to file issues : https://github.com/RhinoSecurityLabs/pacu/issues Maintained by : Rhino Security Labs What is Pacu? Pacu is an open-source AWS exploitation framework, designed for offensive security testi...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

whiskeysamlandfriends

WhiskeySAML and Friends TicketsPlease TicketsPlease: Python library to assist with the generation of Kerberos tickets, remote retrieval of ADFS configuration settings, generation of Golden SAML tokens, and retrieval of Azure Access Tokens. WhiskeySAML WhiskeySAML: Proof of concept tool for a Gold...

PwnKit-Exploit

PwnKit-Exploit CVE-2021-4034 @c0br40x help to make this section in README!! Proof of Concept root@kitploit: debian@debian:/PwnKit-Exploit$ make cc -Wall exploit.c -o exploit debian@debian:/PwnKit-Exploit$ whoami debian debian@debian:/PwnKit-Exploit$ ./exploit Current User before execute exploit...

BackupOperatorToDA

From Backup Operator To Domain Admin If you compromise an account member of the group Backup Operators you can become the Domain Admin without RDP or WinRM on the Domain Controller. All credit from filipdragovic with his inital POC ! I build this project because I wanted to have a more generic...

MultiPotato

MultiPotato First of all - credit to @splintercode & @decoderit for RoguePotato as this code heavily bases on it. This is just another Potato to get SYSTEM via SeImpersonate privileges. But this one is different in terms of It doesn't contain any SYSTEM auth trigger for weaponization. Instead the...

SCMKit

SCMKit Description S ource C ode M anagement Attack Toolkit - SCMKit is a toolkit that can be used to attack SCM systems. SCMKit allows the user to specify the SCM system and attack module to use, along with specifying valid credentials username/password or API key to the respective SCM system...

RootHelper

RootHelper Roothelper will aid in the process of privilege escalation on a Linux system that has been compromised. The latest version totals eleven scripts. From enumeration to exploit suggestion to exploit deployment. RootHelper ensures you have access to the best tools for the job. The credits...

linux-kernel-exploits

linux-kernel-exploits Introduction linux-kernel-exploits Vulnerability List CVE Description Kernels CVE–2018–18955 mapwrite in kernel/usernamespace.c allows privilege escalation Linux kernel 4.15.x through 4.19.x before 4.19.2 CVE–2018–1000001 glibc glibc 2.6.22 released in 2007 CVE-2016-2384 a...

CVE-2026-81445

Dell OpenManage Server Administrator versions prior to 11.1.0.3 contain an Improper Privilege Management vulnerability. A high-privileged attacker with remote access could exploit it to achieve elevation of privileges , resulting in high impact to confidentiality, integrity, and availability (CVS...

Reg1c1de

Reg1c1de: Windows Registry Privesc Scanner Summary from help output: Reg1c1de is a tool that scans specified registry hives and reports on any keys where the user has write permissions In addition, if any registry values are found that contain file paths with certain file extensions and they are...

RottenPotato

This code is no longer maintained - for a newer implementation see https://github.com/breenmachine/RottenPotatoNG RottenPotato Local Privilege Escalation from Windows Service Accounts to SYSTEM For a technical overview of this exploit see our blog post at...

reconerator

Overview This is a custom .NET assembly which will perform a number of situational awareness activities. There are a number of current featuresets: BASIC - Obtains information from the disk and registry. LDAP - Allows customised AD LDAP queries to be made. RESOLVEHOST - Performs DNS lookup querie...

powerob

Powerob An on-the-fly Powershell script obfuscator meant for red team engagements. Built out of necessity. This only obfuscates functions and removes found in PowerShell scripts. Roadmap includes bfuscating variables. Pull requests and collaborative welcomed. About This was built out of the need ...

Local privilege escalation due to insecure file permissions

Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments...

Aaia

NOTE This repository is not under active development. However, I am open to accepting PRs. Aaia still works as there has been no significant changes in terms of AWS APIs it uses to collect data. Aaia Analysis of Identity and Access Note: Expansion created post the name was decided :P What does Aa...