ransomware-simulator

QuickBuck - 勒索软件模拟器 root@kitploit: / \ / / / / / / // // // // // // '// |/ // // // '/ \\,/// ///\// ,/ ///\ Nextron Systems GmbH 本仓库的目标是提供一种简单、无害的方式来检查您的防病毒软件对勒索软件的防护能力。 该工具模拟典型的勒索软件行为，例如： 从 Word 文档宏中分阶段释放 删除卷影副本 加密文档（由模拟器嵌入并投放至新文件夹中） 将勒索信投放到用户桌面...

SAMDump

SAMDump 使用卷影复制服务（VSS）提取 Windows SAM 和 SYSTEM 文件，支持多种渗出选项和 XOR 混淆： 使用 VSS 列出卷影副本，并在必要时创建一个 从卷影副本中提取 SAM 和 SYSTEM 文件 使用 NT API 调用进行文件操作（NtCreateFile, NtReadFile, NtWriteFile） 支持用于混淆的 XOR 编码 渗出方式：本地保存或网络传输 它使用 C++、C、Crystal 和 Python 实现，适用于现代 Windows 版本。 它需要提升权限，如果创建了卷影副本，该副本会在约 5 分钟后自动删除。 使用...

Invoke-HiveNightmare

Invoke-HiveNightmare PowerShell-based PoC for CVE-2021-36934, which enables a standard user to be able to retrieve the SAM, Security, and Software Registry hives in Windows 10 version 1809 or newer. Situation In specific versions of Windows 10, standard users have read/execute rights to files in...

vss-fr2system

vss-fr2system Dos pequeñas herramientas que convierten un fallo de lectura arbitraria de archivos en Windows en un shell SYSTEM. vssfreeze/ — crea una copia de sombra de volumen como usuario estándar , luego la mantiene abierta para que tengas tiempo de leer los archivos SAM/SECURITY/SYSTEM de el...

poc_CVE-2021-36934

pocCVE-2021-36934 POC experimentos con Volume Shadow copy Service VSS...

IRTriage

应急响应分类： 脚本化收集对取证分析师有价值的系统信息。 IRTriage 在所有 Windows 版本（WinXP 除外）中会自动“以管理员身份运行”。 原始来源是 Triage-ir v0.851，这是由 Michael Ahrendt 编写的 Autoit 脚本。 不幸的是，Michael 最后的更改于 2012 年 11 月 9 日 发布。 我已通知 Michael 知道 我 fork 了他的项目： 我很高兴地宣布，他同意我 fork 他的源代码，开源万岁！ 如果在事件响应期间无法获取完整磁盘镜像怎么办？ 假设你正在调查十几台可能被感染或受损的系统。 你能花 2-8...

smbexec

root@kitploit: smbexec A rapid psexec style attack with samba tools Original Concept and Script by Brav0Hax & PureHate Ported to ruby and modified by Smilingraccoon and Zeknox Codename - Machiavellian Written because we got sick of Metasploit PSExec getting popped Special thanks to Carnal0wnage...

Raccine

Raccine Una protección sencilla contra el ransomware Por qué Con frecuencia vemos ransomware que elimina todas las copias de sombra mediante vssadmin. ¿Y si pudiéramos interceptar esa petición y matar el proceso que la invoca? Intentemos crear una vacuna sencilla. Cómo funciona Registramos un...

honda

RoguePlanet by Nightmare-Eclipse HONDA by nu11secur1ty Vulnerabilidad de Windows Defender de RoguePlanet Autores: Desarrollador original del exploit Nightmare-Eclipse Desarrollo, pruebas y weaponización nu11secur1ty Ingeniero de Pruebas de Penetración 🧠 Análisis Técnico por nu11secur1ty El exploi...

Anti-Forensics

Anti-Forensia Un Repositorio para Rastrear Técnicas Anti-Forenses Esta lista se basa en la respuesta de la comunidad DFIR y en las técnicas que actualmente cubrimos en nuestro curso de Anti-Forensia. ¿Tienes alguna idea genial de Anti-Forensia para compartir? DFIR DigitalForensics...

CVE-2026-72985

Heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges with a physical attack...

CVE-2026-72985

A heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker with physical access to escalate privileges, potentially compromising confidentiality, integrity, and availability (CVSS 6.8, MEDIUM). The vulnerability requires no prior privileges or user interaction, but...

EUVD-2026-73737

Heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges with a physical attack...

Volume Shadow Copy Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges with a physical attack...

PT-2026-87895

Heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges with a physical attack...

Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation

Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation By Adithya Chandra and Maulik Maheta · August 18, 2026 Executive Summary While attackers continuously cycle through new tooling, their underlying techniques remain remarkably consistent. Credential theft from...

Windows Defender (MsMpEng.exe) - Race Condition

Titles: Windows Defender MsMpEng.exe - Race Condition Author: nu11secur1ty Date: 2026-06-11 Vendor: Microsoft Corporation Software: Windows Defender Antivirus MsMpEng.exe Reference: https://gitlab.com/nu11secur1ty/0/-/raw/main/README.md?reftype=heads Description: A race condition exists between...

Security Bulletin: IBM System Storage Support for Microsoft Volume Shadow Copy Service and Virtual Disk Service is vulnerable due to jackson-core. (CVE-2025-52999)

Summary jackson-core-2.13.1.jar is updated to jackson-core-2.18.3.jar in the latest IBM System Storage Support for Microsoft Volume Shadow Copy Service and Virtual Disk Service repo where security vulnerability is not observed. CVE-2025-52999. Vulnerability Details CVEID:CVE-2025-52999 DESCRIPTIO...

MiracleLinux 4 : samba-3.6.23-24.AXS4 (AXSA:2016-013:01)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-013:01 advisory. Samba is the suite of programs by which a lot of PC-related machines share files, printers, and other information such as lists of available files an...

MiracleLinux 4 : samba4-4.0.0-67.AXS4.rc4 (AXSA:2016-012:01)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-012:01 advisory. Samba is the standard Windows interoperability suite of programs for Linux and Unix. Security issues fixed with this release: CVE-2015-3223 The...