ROP_ROCKET

Introducing the ROP ROCKET This new, advanced ROP framework made it debute at at DEF CON 31 with some unprecedented capabilities. ROCKET generates several types of chains, and it provides new patterns or techniques. Please note that this is still a work in progress, with some updated and enhanced...

CVE-2026-42980-POC

CVE-2026-42980 Public Disclosure This repository contains the public disclosure material for CVE-2026-42980 , a Windows kernel WMI integer-underflow vulnerability that can be exploited for local privilege escalation to NT AUTHORITY\SYSTEM on vulnerable lab builds. Full write-up English article...

CVE-2018-7449

CVE-2018-7449 1. Introduction My tool is written in Python and exploits the CVE-2018-7449 vulnerability to execute a series of commands that will crash the ftp daemon. DISCLAIMER!!! Please note that the use of hacking tools without authorization is illegal and could result in legal problems...

MEC

Masked Extension Control MEC Masked Extension Control MEC Masked Extension Control is a program that makes your Windows rely on magic numbers, and not only on extensions, to choose the program that will be used to open the file. This is much safer for your system, since a lot of attacks begin by...

CVE-2021-31166-exploit

CVE-2021-31166 HTTP Protocol Stack Remote Code Execution Vulnerability Attacked version： Microsoft:Windows 10: version 2004 for 32-bit Systems version 2004 for x64-based Systems version 2004 for ARM64-based Systems version 20H2 for 32-bit Systems version 20H2 for x64-based Systems version 20H2 fo...

zeek-quasarrat-detector

A Zeek Based QuasarRAT Malware Detector Malware often hides communications with its command and control C2 server over HTTPS. The encryption in HTTPS usually conceals the compromise long enough for the malware to accomplish its goal. This makes detecting malware that uses HTTPS challenging, but...

CVE-2021-1732-Exploit

CVE-2021-1732-Exploit CVE-2021-1732 Exploit Only tested on windows10 1909 x64...

PrintNightmare

Windows Print Spooler Service RCE CVE-2021-1675 PrintNightmare How to disable the Print Spooler service ? CMD Shell net start | findstr -i "spooler" net stop spooler REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\Spooler" /v "Start " /t REGDWORD /d "4" /f PowerShell Get-Service -Name Spooler...

CVE-2020-1350

CVE-2020-1350 Scanner and Mitigator for CVE 2020-1350 How to run: 1- Run as Administrator windows commandline. 2- powershell -ExecutionPolicy Bypass -File CVE-2020-1350.ps1...

CVE-2021-1675-PrintNightmare

CVE-2021-1675 - PrintNightmare LPE PowerShell Caleb Stewart | John Hammond | June 1, 2021 CVE-2021-1675 is a critical remote code execution and local privilege escalation vulnerability dubbed "PrintNightmare." Proof-of-concept exploits have been released Python, C++ for the remote code execution...

Log4j-Windows-Scanner

Log4j-Windows-Scanner CVE-2021-44228 vulnerability in Apache Log4j library | Log4j vulnerability scanner on Windows machines. How does it work It detects the vulnerable versions of log4j by following the folders in the C Directory. When it exposes vulnerable files, it reveals ".TXT" files as...

loldrivers-client

LOLDrivers-client The OG, blazingly fast , zero dependencies client for LOLDrivers by MagicSword. Scan your Windows computer for known vulnerable or malicious drivers. Installation Command Line Copy and paste the command below into a PowerShell terminal. This does not require an elevated...

CVE-2024-4577

CVE-2024-4577 PoC Exploit Description This repository contains a proof-of-concept PoC exploit for CVE-2024-4577, a critical vulnerability affecting all versions of PHP running on Windows. The vulnerability allows attackers to execute arbitrary code remotely. The flaw also impacts the XAMPP...

CVE-2016-3308

Use CVE-2016-3308 corrupt win32k desktop heap author : @55-AA, Sept 18, 2016 Introduction Desktop heap is a kernel pool used by win32k, it can be exploited by user-mode application. Here I will describe in detail how to implement a reliable exploitation so that to read/write arbitrary address in...

SetupHijack

SetupHijack Overview SetupHijack is a security research tool that exploits race conditions and insecure file handling in Windows installer and update processes. It targets scenarios where privileged installers or updaters drop files in %TEMP% or other world-writable locations, allowing an attacke...

maps_scanner

MAPS Cloud Scanner A research tool for interacting with Windows Defender's MAPS Microsoft Active Protection Service cloud-based file reputation and dynamic signature delivery system. MAPS is the cloud backend that powers Defender's real-time protection verdicts, sample submission pipeline, and...

Geutebrueck_GCore_X64_RCE_BO

GeutebrueckGCoreX64RCEBO Metasploit module for Geutebrueck GCore "video management" system. Tested with version 1.3.8.42 and 1.4.2.37. Full remote code execution with NT/System privileges on Windows Win 2012R2,Win8.1,... with the installed Geutebrueck products GCore. Authors:...

peeping-tom

peeping-tom Remote keylogger for Windows written in C++ Welcome to the peeping-tom project repo! Peeping-tom is a two-part program with a peeping-client deployed on a target and a toms-server listening for keylogs on the attacker machine. Getting up and running requires a decent amount of set up,...

PhantomFS

Fake Files. Real Security. Virtual honeypot file system for Windows — lure attackers into a directory that looks real, then catch them in the act. What Is PhantomFS? PhantomFS uses the Windows Projected File System ProjFS to surface a virtual directory full of convincing decoy files — financial...

Crow-Eye

Crow-Eye — Windows Forensics Engine A forensic time machine for Windows. Crow-Eye doesn't just detect — it reconstructs what actually happened on the timeline, from acquisition all the way to a verdict traceable to its source records. Table of Contents Overview ✨ Highlights 👥 Who Crow-Eye Is For ...