wanderer

Wanderer Wanderer es un programa de código abierto que recopila información sobre los procesos en ejecución. Esta información incluye el nivel de integridad, la presencia de AMSI como módulo cargado, si se ejecuta en 64 o 32 bits, así como el nivel de privilegios del proceso actual. Esta...

SharpEDRChecker

SharpEDRChecker Nueva y mejorada implementación en C de Invoke-EDRChecker. Comprueba procesos en ejecución, metadatos de procesos, DLLs cargadas en el proceso actual y metadatos de cada DLL, directorios de instalación comunes, servicios instalados y metadatos binarios de cada servicio,...

Enumprotections_BOF

Enumprotections BOF This BOF can be used to enumerate system processes and identify the protection level of each one. Additional information, like service relation, user, session, and path, are also returned. This information in combination can be used to identify good candidates to explore for...

0xKern3lCrush

💀 0xKern3lCrush-M4te-CVE-2026-0828 Windows BYOVD Research & Endpoint Recon Notes Strictly educational / security research repository. Goal: Document and understand Bring-Your-Own-Vulnerable-Driver BYOVD techniques via public disclosures — zero working exploits included. This repo collects: Safe...

Bin-Finder

Description This tool looks for either the processes that have a certain binary loaded or the processes that don't. This is useful in the following scenarios: It allows to detect processes where an specific EDR/AV dll is not loaded. This could lead to EDR's exception detection. It allows to obtai...

process-enumeration-stealth

🚴 process-enumeration-stealth What is this? This is a simple PoC which allows you to return a list of PIDs currently using NTFS, by querying the \ntfs\ base device the Windows filesystem base object. Using this method circumvents the need to use typical APIs, such as NtQuerySystemInformation or t...

Mhyprot2DrvControl

Mhyprot2DrvControl A lib that allows using mhyprot2 driver for enum process modules, r/w process memory and kill process. Usage Build and run, see Driver\MhyProt2.cs for available function and usage. Demo...

Exploit for CVE-2026-0828

💀 0xKern3lCrush-M4te-CVE-2026-0828 Windows BYOVD Research &...

Inside Raccoon Stealer V2

Raccoon Stealer is back on the news again. US officials arrested Mark Sokolovsky, one of the malware actors behind this program. In July 2022, after several months of the shutdown, a Raccoon Stealer V2 went viral. Last week, the Department of Justice's press release stated that the malware...

Metasploit Wrap-Up

NSClient++ Community contributor Yann Castel has contributed an exploit module for NSClient++ which targets an authenticated command execution vulnerability. Users that are able to authenticate to the service as admin can leverage the external scripts feature to execute commands with SYSTEM level...

Baphomet - Basic Concept Of How A Ransomware Works

This is a proof of concept of how a ransomware works, and some techniques that we usually use to hijack our files. This project is written in C using the net-core application framework 3.1.The main idea of the code is to make it as readable as possible so that people have an idea of how this type...

CVE-2018-1121

Since the kernel's procpidreaddir returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process...

[Show Threads] Tool to list all the Threads in the running Process

Show Threads is the small command-line Tool to list all the Threads in the running Process. You can either specify the Process ID or Process Name to enumerate the threads. For each thread, it displays Thread ID and the Base Priority. Being a command-line tool makes it easy for automation. It can ...

Build a fully functional MYSQL UDF-vulnerability warning-the black bar safety net

Now online through the mysql get system privileges, mostly by the MYSQL user function interface UDF, 比如Mix.dll和myudf.dll the. In the Mix. the dll has a MixConnect function it will bounce the shell, but using this function will cause the MYSQL suspended animation, the other day I used this functio...

Kept in purdah who did not know: FU_Rootkit-vulnerability warning-the black bar safety net

I in 2 0 0 4 year 1 1 period of black anti-posted on the gadgets clever to delete the Guest/Administrator accounts on this article, there are a lot of friends asking about tools is how to write, in fact this tool inside most of the code is my copy FURootkit over. Since friends like, these days I'...