wnfexec

Overview WnfExec is a C proof of concept library that injects shellcode into a process by hijacking a WNF subscription callback then triggering a state change. There's nothing novel here and was built based on the research of others. My intent was to solidfy the concept in my head, document the...

CVE-2023-34312-exp

Disclaimer This project is created only for reproduction experiments. Affected Versions QQ 9.6.2.27855 9.7.11.29088 except QQ 9.7.10, because it does not come with QQProtect.exe apparently TIM 3.4.5.22071 3.4.7.22084 Usage After installing QQ/TIM, place the two malicious DLLs in the same folder a...

Enumprotections_BOF

Enumprotections BOF This BOF can be used to enumerate system processes and identify the protection level of each one. Additional information, like service relation, user, session, and path, are also returned. This information in combination can be used to identify good candidates to explore for...

CVE-2025-61922-PoC

CVE-2025-61922 Exploit: PrestaShop Checkout Account Takeover A simple, educational proof-of-concept script demonstrating the zero-click account takeover vulnerability in the PrestaShop Checkout module CVE-2025-61922. ⚠️ Legal & Ethical Notice: Use Responsibly This tool is for educational purposes...

CVE-2014-4936

CVE-2014-4936: Malwarebytes Anti-Malware and Anti-Exploit upgrade hijacking ============= This repository contains the POC for CVE-2014-4936. A full writeup on how the vulnerability works and how to exploit it using the POC has been published here:...

TeleShadow2

TeleShadow 2 Teleshadow2- Advanced Telegram Desktop Session Hijacker! Stealing desktop telegrams has never been so easy ! Set the email and sender details of the sender and recipient or use Telegram API! and send it to the victim after compiling. How do I use the session file? Delete everything...

CVE-2026-50980

CVE-2026-50980: DNS-Based Cross-Site Scripting XSS & Session Hijacking in oPanel Overview CVE ID: CVE-2026-50980 Product: oPanel Affected Versions: v1.20.25 Vulnerability Type: Stored Cross-Site Scripting XSS via DNS / Session Hijacking Severity: High CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N...

CVE-2010-5230

CVE-2010-5230 Multiple untrusted search path vulnerabilities in MicroStation 7.1 allow local users to gain privileges via a Trojan horse 1 mptools.dll, 2 baseman.dll, 3 wintab32.dll, or 4 wintab.dll file in the current working directory, as demonstrated by a directory that contains a .hln or .rdl...

pwn-pulse

pwn-pulse.sh Exploit for Pulse Connect Secure SSL VPN arbitrary file read vulnerability CVE-2019-11510 Script authored by braindead @BishopFox. Based on research by Orange Tsai and Meh Chang. Thanks also to Alyssa Herrera and 0xDezzy for additional insights. Huge thanks to bl4ckh0l3z for fixing,...

gh-hijack-runner

gh-hijack-runner A python script to create a fake GitHub runner and hijack pipeline jobs to leak CI/CD secrets. Discover more details in the following blogpost: https://www.synacktiv.com/publications/hijacking-github-runners-to-compromise-the-organization Exploitation If you can obtain a...

BlackHat-Europe-2022

BlackHat-Europe-2022 Select Bugs From Binary Where Pattern Like CVE-1337-Days Abstract Static code review is an effective way to discover vulnerability variants and exploitation primitives, but two of the most challenging tasks for static analysis are the effective code pattern extraction from hu...

winsos-poc

WinSOS This technique utilizes executables within the WinSxS folder, commonly trusted by Windows, to exploit the classic DLL Search Order Hijacking method. By leveraging these executables, threat actors can execute malicious code within Windows applications without requiring elevated privileges...

HelakuruV.1.1-DLLHijack

DLL Hijacking Vulnerability in Helakuru Summary The Helakuru Desktop version 1.1v operates on both 64-bit and 32-bit architectures. During testing, it was identified that the program attempts to load wow64log.dll, which is not included by default in modern Windows operating systems. This results ...

CVE-2021-24807

CVE-2021-24807 Support Board 3.3.4 Authenticated Stored XSS Authenticated Stored Cross Site Scripting XSS Vulnerability exists in Support Board Version 3.3.4 via Notes parameter. The impact of cross-site scripting vulnerabilities can vary from one web application to another. It ranges from sessio...

QRLJacking

QRLJacking - A New Social Engineering Attack Vector Find documentation in our Wiki. What is QRLJacking? QRLJacking or Quick Response Code Login Jacking is a simple social engineering attack vector capable of session hijacking affecting all applications that rely on the “Login with QR code” featur...

CS-DropSpawn_BOF

DropSpawn Introduction DropSpawn is a CobaltStrike BOF used to spawn additional Beacons via a relatively unknown method of DLL hijacking. Works x86-x86, x64-x64, and x86-x64/vice versa. Use as an alternative to process injection. Windows executables will follow the DLL search order when trying to...

ExtensionHijack

ExtensionHijacker A possible malware persistence method. Hijacking extensions registered for the current user. Read more here proxyapp - a proxy application, used to handle hijacked extensions hijackerapp - installs the proxy application and redirects extension handling to the proxy...

poc-cribl-rce

Disclaimer This is for informational/educational purposes only. This was put together to demonstrate an insecurity in the tool, in order for a fix to be verified by the vendor. Info Tested on Cribl v1.5.0 - Previous versions not tested but likely vulnerable. A valid JWT token can be transfered fr...

CVE-2026-41940-PoC-Exploit

CVE-2026-41940 - cPanel/WHM Authentication Bypass Exploit cPanel & WHM Edition - CRLF Injection to Authentication Bypass & Full Session Hijacking Overview This exploit leverages CVE-2026-41940 , a critical authentication bypass vulnerability in cPanel/WHM. By injecting a crafted CRLF payload into...

POC-of-CVE-2022-36271

POC-of-CVE-2022-36271 The name of an affected Product : Outbyte PC Repair Installation File The affected version : 1.7.112.7856 The CVE ID for the entry : CVE-2022-36271 Description: iertutil.dll is missing so an attacker can use a malicious dll with same name and can get a admin privileges and...