CVE-2021-36934

CVE-2021-36934 CVE-2021-36934 HiveNightmare vulnerability checker and workaround Flow The script has the following flow: Requires it to run with Administrator privileges Check Windows 10 version is affected by the vulnerability. IF affected by vulnerability: Show Windows version may be affected b...

SrHollow

SrHollow LSA secrets extraction, reuse a preexisting VSS shadow copy + inline regf parser + AES-256 LSA decrypt via bcrypt.dll. Chain in 6 steps 1. Enumerate\GLOBAL?? via NtOpenDirectoryObject + NtQueryDirectoryObject. Pick the highest-numbered HarddiskVolumeShadowCopyN. 2. If none exists , fall...

ShadowSpray

ShadowSpray A tool to spray Shadow Credentials across an entire domain in hopes of abusing long forgotten GenericWrite/GenericAll DACLs over other objects in the domain. Why this tool In a lot of engagements I see in BloodHound that the group "Everyone" / "Authenticated Users" / "Domain Users" or...

windows_kernel_shadow_stack

Proof of Concepts This project aims to highlight certain aspects of the shadow stack mitigation implemented by Microsoft in Windows 11. The code is specifically focused on Windows 11 24H2. It may not work on other version of Windows 11, due to the kernel offset management. The project is divided...

same_type_object_reuse_exploits

PoC Same-Type/Same-Address Object Reuse Exploits PoC exploits developed by Mathias Krause associated with the blog at https://grsecurity.net/exploitinganddefendingagainstsametypeobjectreuse...

smbexec

smbexec A rapid psexec style attack with samba tools Original Concept and Script by Brav0Hax & PureHate Ported to ruby and modified by Smilingraccoon and Zeknox Codename - Machiavellian Written because we got sick of Metasploit PSExec getting popped Special thanks to Carnal0wnage who's blog...

shadow-workers

Shadow Workers Info Shadow Workers is a free and open source C2 and proxy designed for penetration testers to help in the exploitation of XSS and malicious Service Workers SW. A successful exploitation allows you to browse on the targeted application as the victims, as long as the SW agent is...

AIOstack

AI agents always look authorized. AIOStack tells you when they're not. AI agents act on behalf of users. They use real credentials, make real API calls, invoke tools, access APIs, and touch production systems. Most security tools see this activity as legitimate because, technically, it is. The re...

ACLight

ACLight A tool for advanced discovery of Privileged Accounts - including Shadow Admins. ACLight2 is the improved version of the tool. Shadow Admins Research The tool version 1 was published as part of the "Shadow Admins" research - more details on "Shadow Admins" are in the blog post:...

poc_CVE-2021-36934

pocCVE-2021-36934 POC experiments with Volume Shadow copy Service VSS...

KrbRelay

KrbRelay Relaying 3-headed dogs. More details at https://googleprojectzero.blogspot.com/2021/10/windows-exploitation-tricks-relaying.html and https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html This should be working on most fully patched Windows systems...

Whisker

Whisker Whisker is a C tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding "Shadow Credentials" to the target account. This tool is based on code from DSInternals by Michael Grafnetter @MGrafnetter. For this...

Shadow-Vault

Shadow Vault 🔐 Shadow Vault is a lightweight PHP web tool designed for system administrators to securely add new user credentials to shadow files on shared hosting environments. It automatically detects existing shadow aging format, uses SHA-512 password hashing, supports multiple write fallback...

CVE-2020-13886

PoC: https://youtu.be/nNKBRx8IglI ------------------------------------------------------------------------------------------------------------- ------------- 0day: TELEFONE IP TIP200/200 LITE & TIP 300 | Local File Include | ---------------------------- ------------------------------- P0c Author:...

honda

RoguePlanet by Nightmare-Eclipse HONDA by nu11secur1ty RoguePlanet Windows Defender Vulnerability Authors: Original Exploit Developer Nightmare-Eclipse Developing, testing, and weaponization nu11secur1ty Penetration Testing Engineer 🧠 Technical Analysis by nu11secur1ty The exploit leverages a rac...

CVE-2024-22894

CVE-2024-22894 Downloaded the latest heatpump firmware version wp2reg-V3.88.0-9015 of https://www.heatpump24.com/DownloadArea.php. Within this firmware is a file called : wp2reg-V3.88.0-9015\wp2reg-AlphaInnotech-prod\home.wp2reg-V3.88.0-9015221213\share\shadow This contains a 3DES encrypted...

shadow-repeater

Shadow Repeater Shadow Repeater enhances Burp Suite’s Repeater by automatically generating and testing variations of your payloads to uncover potential security weaknesses. Whether you're probing for path traversal, SQL injection, XSS, or other vulnerabilities, Shadow Repeater intelligently mutat...

Zydra

Zydra Zydra is a file password recovery tool and Linux shadow file cracker. It uses the dictionary search or Brute force method for cracking passwords. Supported Files RAR Files Legacy ZIP Files PDF Files Linux Shadow Files zydra can find all the user’s password in the linux shadow file one after...

CVE-2021-36934

CVE described on MSRC. Remediated using ECM aka SCCM Config Items: See the remediation and Discovery scripts in repo. Config Item does a boolean $false check for compliance. Remediation In production, we found the need to remediate purge copies other than ClientAccessible ones; we've seen Backup...

scopeblind-gateway

⚠️ This repository has moved. Active development continues at ScopeBlind/scopeblind-gateway. This personal fork may be behind the canonical repository. Please use the org repo for issues, pull requests, and the latest code. protect-mcp Security gateway for MCP servers. Shadow-mode logs by default,...