CVE-2024-4947

CVE-2024-4947 A in-the-wild V8 type confusion bug. This repository contains Analysis and PoCs to escalate this vulnerability to have the same exploit pattern as CVE-2024-12695, Object Hash Reassign. AddressOf / FakeObject Primitives constructed by using the type confusion to assign object hash to...

Dagon

Dagon - Advanced Hash Manipulation Named after the prince of Hell, Dagon day-gone is an advanced hash cracking and manipulation system, capable of bruteforcing multiple hash types, creating bruteforce dictionaries, automatic hashing algorithm verification, random salt generation from Unicode to...

CVE-2023-3450

CVE-2023-3450 fofa：iconhash="-399311436" 案例：http://123.54.231.201:6060 Usage: python3 CVE-2023-3450.py -h, --help python3 CVE-2023-3450.py -u URL, --url URL python3 CVE-2023-3450.py -f FILE, --file FILE...

hashes

Magic hashes – PHP hash "collisions" Register with password 1 and then sign in with password 2. If you're in then the storage uses specified algorithm to hash the password and PHP uses == to compare them for MD5, SHA-1, and plaintext. MD5, SHA-1, SHA-224, SHA-256 and others For MD5 , SHA-1 and...

CVE-2022-25012

Argus Surveillance DVR 4.0 - Weak Password Encryption CVE-2022-25012 Updated version of this weak password encryption script Exploit DB REF: https://www.exploit-db.com/exploits/50130 Author REF: https://deathflash1411.github.io/blog/dvr4-hash-crack NIST REF:...

telfhash

Trend Micro ELF Hash telfhash telfhash is symbol hash for ELF files, just like imphash is imports hash for PE files. With telfhash, you can cluster ELF files by similarity based on symbols. This is particularly useful for clustering malicious samples. If a sample has no symbols, telfhash uses its...

ADenum

Active directory enumeration - ADEnum.py ADEnum.py is a pentesting tool that allows to find misconfiguration through the protocol LDAP and exploit some of those weaknesses with Kerberos. █████╗ ██████╗ ███████╗███╗ ██╗██╗ ██╗███╗ ███╗ ██╔══██╗██╔══██╗ ██╔════╝████╗ ██║██║ ██║████╗ ████║ ███████║█...

cve-2021-38314

CVE-2021-38314 Python Exploit Detail The Gutenberg Template Library & Redux Framework plugin = 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php that were unique to a given site but deterministic and...

CVE-2016-5639

CVE-2016-5639 Crestron AirMedia AM-100 Traversal and Hashdump Metasploit Modules Two similar modules that take advantage of CVE-2016-5639 to dump hashes and retrieve files through path traversal. I made these modules separate because I wanted experience writing something that could "dump" hashes,...

Karkinos

Disclaimer This is an OLD project I did in university... all code was improvised as I progressed, and hardly anything was planned. This tool should be used on applications/networks that you have permission to attack only. Any misuse or damage caused will be solely the users’ responsibility. What ...

Bad-Pdf

Bad-Pdf Bad-PDF create malicious PDF file to steal NTLMNTLMv1/NTLMv2 Hashes from windows machines, it utilize vulnerability disclosed by checkpoint team to create the malicious PDF file. Bad-Pdf reads the NTLM hashes using Responder listener. This method work on all PDF readersAny version most of...

RDPassSpray

RDPassSpray RDPassSpary is a python tool to perform password spray attack in a Microsoft domain environment. ALWAYS VERIFY THE LOCKOUT POLICY TO PREVENT LOCKING USERS. How to use it First, install the needed dependencies: pip3 install -r requirements.txt Second, make sure you have xfreerdp: apt-g...

smbexec

smbexec A rapid psexec style attack with samba tools Original Concept and Script by Brav0Hax & PureHate Ported to ruby and modified by Smilingraccoon and Zeknox Codename - Machiavellian Written because we got sick of Metasploit PSExec getting popped Special thanks to Carnal0wnage who's blog...

CVE-2021-24891-Simulation

A hands-on, containerized lab environment to simulate and exploit a DOM-based Cross-Site Scripting XSS vulnerability in the Elementor Website Builder WordPress plugin, identified as CVE-2021-24891. 📖 About The Vulnerability This lab demonstrates a DOM-based Cross-Site Scripting XSS vulnerability ...

Exploit_CVE-2021-24762

exploitcve-2021-24762 This repo shows an exploit to CVE-2021-24762. This is an Blind SQLi exploit that, on default config, greps the admin password. While doing a lab, based on Wordpress with PerfectSurvey plugin, I stucked on a sql vulnerability. The only available PoC I found were based on sqlm...

LeakedWallpaper

Leaked Wallpaper This is a privilege escalation tool fixed with CVE-2024-38100 in KB5040434 that allows us to leak a user's NetNTLM hash from any session on the computer, even if we are working from a low-privileged user. Usage .\LeakedWallpaper.exe \\c$\1.jpg -downgrade Example...

xortool

xortool.py A tool to do some xor analysis: guess the key length based on count of equal chars guess the key base on knowledge of most frequent char Notice: xortool is now only running on Python 3. The old Python 2 version is accessible at the py2 branch. The pip package has been updated...

xfg_analyzer

Recovering function prototypes by bruteforcing XFG Hashes This repository contains scripts for generating and looking up eXtended Flow Guard hashes. An extended writeup of how this works is available in issue 22 of International Jouranl Of Proof Of Concept || GTFO. My work on this PoC was greatly...

ZeroLogon-Exploit

ZeroLogon - Exploit and Example Modified the test PoC from Secura, CVE-2020-1472, in order to change the machine's password to null. Changing the password on the machine uses Microsoft's NetrServerPasswordSet2 function. This exploit takes advantage of Impacket's nrpc.py module to call...

CVE-2025-24071-POC-NTLMHashDisclosure-

CVE-2025-24071-POC-NTLMHashDisclosure Triggers automatic SMB authentication to an attacker-controlled share. No interaction required — Windows Explorer initiates this NTLM authentication automatically. Results in NTLMv2 hash leakage information disclosure. Affects Windows 10/11 all versions,...