CrystalPotato

CrystalPotato Crystal port of GodPotato, a local privilege escalation from accounts with SeImpersonatePrivilege to SYSTEM. It works by abusing the DCOM OXID Resolver and named pipe impersonation. Windows APIs are resolved dynamically and invoked through indirect syscall stubs, all strings are...

CVE-2024-42049-PoC

CVE-2024-42049-PoC CVE Details https://nvd.nist.gov/vuln/detail/CVE-2024-42049 TightVNC Server for Windows before 2.8.84 allows attackers to connect to the control pipe via a network connection. PoC Details article: https://izvd.eu/research/exploiting-cve-2024-42049 tested on: 2.7.10, 2.8.81; mos...

exploit-CVE-2017-7494

SambaCry RCE exploit for Samba 4.5.9 Samba is a free software re-implementation of the SMB/CIFS networking protocol. Samba provides file and print services for various Microsoft Windows clients and can integrate with a Microsoft Windows Server domain, either as a Domain Controller DC or as a doma...

exploit-CVE-2017-7494

SambaCry RCE exploit for Samba 4.5.9 Samba is a free software re-implementation of the SMB/CIFS networking protocol. Samba provides file and print services for various Microsoft Windows clients and can integrate with a Microsoft Windows Server domain, either as a Domain Controller DC or as a doma...

SharpNamedPipePTH

SharpNamedPipePTH This project is a C tool to use Pass-the-Hash for authentication on a local Named Pipe for user Impersonation. You need a local administrator or SEImpersonate rights to use this. There is a blog post for explanation: https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/ It is heavily...

thats_no_pipe

Thats no pipe Frida-based project to intercept Windows named pipe communication Objectives This project aims at intercepting IPC communications by hooking specific WinAPI functions and forwarding them to an HTTP proxy using a websocket. Architecture Read from and write to a named pipe can happen ...

NamedPipePTH

NamedPipePTH This project is a PoC code to use Pass-the-Hash for authentication on a local Named Pipe user Impersonation. There also is a blog post for explanation: https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/ It is heavily based on the code from the projects Invoke-SMBExec.ps1 and RoguePotat...

CVE-2024-40586-Windows-Coerced-Authentication-in-FortiClient

CVE-2024-40586 Windows Coerced Authentication in FortiClient On Windows system, it was found that FortiClient App version 7.0.8.0427 allow a remote unprivileged user to coerce Windows hosts authenticate to other machines via a named pipe responsible for FortiSSLVPNdaemon service. It was observed...

FortiLPE

Description Local privilege escalation PoC exploit for CVE-2025-62676 / EUVD-2025-206993 that targets FortiClient VPN running on Windows. Executes a payload in the context of SYSTEM from a normal user context via an arbitrary XML file write. The PoC has been tested against FortiClient version 7.4...

PetitPotato

PetitPotato Local privilege escalation via PetitPotam Abusing impersonate privileges. Description PetitPotam uses MS-EFSR Encrypting File System Remote, a protocol used to perform maintenance and management operations on encrypted data stored remotely and accessed over a network. There are a seri...

PrintSpoofer-ReflectiveDLL

PrintSpoofer Details PrintSpoofer is a tool that performs local privilege escalation by exploiting a vulnerability in the Windows Print Spooler service CVE-2019-1040 / CVE-2019-1019. This project implements the PrintSpoofer exploit in Reflective DLL format, making it suitable for use with...

CVE-2024-0311

CVE-2024-0311 ? This is a PoC for what I believe is CVE-2024-0311, SB10418. A malicious insider can bypass the existing policy of Skyhigh Client Proxy without a valid release code. Much details. Very exploit. ¯\ツ /¯ The PoC injects into a user-ran SCPBypass.exe process and writes to the...

CVE-2022-24924

Improper access control vulnerability in LiveWallpaperService CVE-2022-24924SVE-2021-24089 Windows version tested: Windows 10 20H2 Build 19042.1348 64bit Live Wallpaper Version: 3.0.9.0 or earlier There is a LiveWallpaperService that works by default in Samsung laptops, but there was a...

InjectSetConsole

InjectSetConsole InjectSetConsole performs process code injection by leveraging a Windows named pipe. Unlike traditional techniques, it does not use the VirtualAllocEx and WriteProcessMemory APIs. Command Line Syntax InjectSetConsole.exe executablepath : netsh.exe, nslookup.exe,... or other...

CVE-2017-7494

SambaCry CVE-2017-7494 Exploit CVE-2017-7494/SambaCry allows authenticated users to upload a shared library to a writeable folder, and perform execution attack using the upload libraries. Vulnerability explanation SambaCry is a path-validation vulnerability in how Samba handles named-pipe request...

CVE-2020-11492

CVE-2020-11492 Proof-of-Concept PoC for Docker Desktop for Windows privilege escalation vulnerability. This vulnerability was patched in Docker version 2.3.0.2 on May 11th, 2020. This PoC performs the following: creates a named pipe mimicking docker named pipe \.\pipe\dockerLifecycleServer, call...

RPC-Backdoor

RPC Backdoor Emulation This project is a basic implementation of an "RPC Backdoor" meant to emulate TTPs used by certain groups. The project contains an RPC server with five functions: Execute a command with cmd.exe /c and the CreateProcess API call. Steal a token and execute a command with cmd.e...

Aladdin

Aladdin .-. .-''-., | //\ ";\ "/ \ , |'./ \ '='-, /\ \ || ///\ '. T |\ | /,-' '. '..-' /'/ | | '. .'-../ ,\ / '-' |/ /-----j .--..--'\ / --' '---. / '---. -'. .' .-- '. \ '--. ;.-o / '. /.8----' c-'----' Lefty @lefterispan - Nettitude Red Team - 2022 / 2023 About Aladdin is a payload generation...

CVE-2026-8069

From an Acer Named Pipe to NT AUTHORITY\SYSTEM: CVE-2026-8069 Acer NitroSense and PredatorSense 3.x installed a Windows service called PSSvc that exposed a custom named-pipe protocol to local users. One protocol command accepted a caller-controlled executable path, duplicated the token of...

psexec_noinstall

psexecnoinstall The repository contains psexec, which will help to exploit the forgotten pipe Have a non-genius administrator connect using PsExec to the host: We discovered this when we saw the RemComCommunication bundle. This one is standard for PsExec Using psexecnoinstall, it is possible to...