CVE-2019-1458

CVE-2019-1458 Windows LPE Exploit Caution YOU ONLY HAVE ONE CHANCE TO EXPLOIT FOR EACH KERNEL REBOOT!!!! Screenshot Supported Version Windows 2012 R2 Tested Windows 8 Tested Windows 2008 R2 x64Tested Windows 7.1 x64 Tested Windows 7 x64 Windows 2012 x64 Windows 2008 x64 ALL X32 VERSION SYSTEMS AR...

DefCon25

Lab Setup 1. x2 VM's = Win7 x64 & Win10RS1/2 x64 2. Extract "DefCon-Tool.zip" to the root of the C drive 3. Follow slides and Lab-Writeup.txt...

ThemeBleedPy

A huge thanks to gabek for the initial PoC in C, and actually finding this CVE, this is a remake of his code in python, reusing his stage files. To see the initial PoC view his page for it here: https://github.com/gabe-k/themebleed ThemeBleedPy A proof of concept using python for the CVE-2023-381...

gftrace

gftrace A command line Windows API tracing tool for Golang binaries. Note: This tool is a PoC and a work-in-progress prototype so please treat it as such. Feedbacks are always welcome! How it works? Although Golang programs contains a lot of nuances regarding the way they are built and their...

CVE-2020-17103

🛡️ MiniPlasma - CVE-2020-17103 A Windows Local Privilege Escalation Zero-Day Turning placeholder files into SYSTEM access 📋 Overview MiniPlasma is a powerful local privilege escalation exploit targeting CVE-2020-17103 in the Windows Cloud Files Mini Filter Driver cldflt.sys. It allows any standard...

CVE-2026-40369

🚨 CVE-2026-40369 - Windows Kernel Elevation of Privilege Vulnerability Windows Kernel Heap-Based Buffer Overflow allowing local attackers to elevate privileges toNT AUTHORITY\SYSTEM. 📖 Overview CVE-2026-40369 is a High Severity privilege escalation vulnerability affecting Microsoft Windows Kernel...

CVE-2016-3309_Reloaded

Kernel Exploitation Case Study - "Wild" Pool Overflow on Win10 x64 RS2 CVE-2016-3309 Reloaded This Github repo contains exploits for the recently-patched win32kfull!bFill vulnerability. Executing the Palette or Bitmap exploit will give you SYSTEM privileges on the affected system. The exploits...

keimpx

Introduction keimpx is an open source tool, released under the Apache License 2.0. It can be used to quickly check for valid credentials across a network over SMB. Credentials can be: Combination of user / plain-text password. Combination of user / NTLM hash. Combination of user / NTLM logon...

lifer

lifer A forensic tool for Windows link file examinations i.e. Windows shortcuts SYNOPSIS 'lifer' is a Windows or nix command-line tool inspired by the whitepaper 'The Meaning of Link Files in Forensic Examinations' by Harry Parsonage and available here. It started life as a lightweight tool that ...

BlueSAM

BlueSAM BOF A Cobalt Strike Beacon Object File adaptation of BlueHammer that attempts to obtain a copy of the SAM database through Windows Defender update/VSS behavior and process offline registry data from Beacon. Credits to Nightmare-Eclipse's BlueHammer...

CVE-2020-0728

CVE-2020-0728 Details The TrustedInstaller.exe service is running as NTAUTHORITY\SYSTEM and is hosting the Sxs Store Class 3C6859CE-230B-48A4-BE6C-932C0C202048 COM service along with the interface ISxsStore. The access permissions...

pytmipe

PYTMIPE & TMIPE PYTMIPE PYthon library for Token Manipulation and Impersonation for Privilege Escalation is a Python 3 library for manipulating Windows tokens and managing impersonations in order to gain more privileges on Windows. TMIPE is the python 3 client which uses the pytmipe library...

nim-shell

Nim-Shell Reverse shell that can bypass EDR and windows defender detection Please do not upload to VirusTotal 𝗜𝗡𝗦𝗧𝗔𝗟𝗟𝗔𝗧𝗜𝗢𝗡 𝗜𝗡𝗦𝗧𝗥𝗨𝗖𝗧𝗜𝗢𝗡𝗦 $ apt install nim Compilation nim c -d:mingw --app:gui nimshell.nim Change the IP address and port number you want to listen to in the nimshell.nim file accordin...

bdapiutil-bydov

BdApiUtil64.sys BYOVD C++ demonstration tool for Windows that interacts with the BdApiUtil device via DeviceIoControl and a specific IOCTL to request the termination of a process. Requirements 64-bit Windows 10/11 Visual Studio / MSVC BdApiUtil64.sys driver loaded and accessible Administrative...

columbo

Columbo Columbo is a computer forensic analysis tool used to simplify and identify specific patterns in compromised datasets. It breaks down data to small sections and uses pattern recognition and machine learning models to identify adversaries behaviour and their possible locations in compromise...

PT-ToolKit

PT-ToolKit Exploits, Powershell Scripts, Executables that are useful during Penetration-Testing or Red Team engagement Most of the Tools and Script are aimed to Active-Directory environment and windows platfform Table of Contents Exploits PowerShell-Scripts Windows-Binary Exploits: Some exploits...

Reg1c1de

Reg1c1de: Windows Registry Privesc Scanner Summary from help output: Reg1c1de is a tool that scans specified registry hives and reports on any keys where the user has write permissions In addition, if any registry values are found that contain file paths with certain file extensions and they are...

PhantomCtx

PhantomCtx PhantomCtx is a tool that automates Activation Context hijacking with the objective of loading an arbitrary DLL into the vast majority of signed executables e.g. Microsoft, Adobe, Mozilla. The loader is presented as a modern alternative to traditional DLL Hijacking & Sideloading: unlik...

DLLHijackHunter

DLLHijackHunter By ProjectMerai Automated DLL Hijacking Discovery, Validation, and Confirmation Turning local misconfigurations into weaponized, confirmed attack paths. Overview DLLHijackHunter is an automated Windows DLL hijacking detection tool that goes beyond static analysis. It discovers,...

uac-a-mola

uac-a-mola Installation To install uac-a-mola you have to perform the following actions: 1. Download and install python 2.7.x for Windows taking into account your particular infrastructure, you can find the binaries here: https://www.python.org/downloads/ 2. Add the python path to the path...