Windows_AFD_LPE_CVE-2023-21768

CVE-2023-21768 Local Privilege Escalation POC authors: chompie & b33f 复现文章:hlingxbm For demonstration purposes only. Complete exploit works on vulnerable Windows 11 22H2 systems. Write primitive works on all vulnerable systems. Usage: WindowsAFDLPECVE-2023-21768.exe where is the process ID in...

CVE-2024-38063

CVE-2024-38063 Windows Vulnerability that allows the implementation of unauthorised activity over the network: remote execution of Windows TCP/IP remote code. Two virtual machines - a victim and an attacker - are ready to simulate the attack. On the victim machine, a tool for capturing network...

BlueDoor

BlueDoor CTF Challenge Overview Challenge Name : BlueDoor CVE : CVE-2017-0144 EternalBlue Difficulty : 3/5 Category : Exploitation, Windows Authors : Seth Davis BlueDoor simulates a real-world vulnerability EternalBlue - CVE-2017-0144 in a Windows 7 system. The objective is to exploit the...

CVE-2025-24071

CVE-2025-24071 Windows File Explorer Spoofing Vulnerability - CVE-2025-24071 Leak the NTLM hash of Windows through the extraction of a manipulated ZIP or RAR file, and by exploiting a vulnerability in the handling of .library-ms files a type of file used by Windows to specify libraries and networ...

CVE-2021-1732

CVE-2021-1732 The vulnerability occurs in the Windows graphics driver win32kfull!NtUserCreateWindowEx function due to a desynchronization between kernel callback user-mode memory allocation and the setting of the tagWND-flag attribute. This allows an attacker to forge the tagWND-offset value,...

CVE-2015-1578-PoC-Metasploit

CVE-2015-1578 Metasploit Module Overview This is a Metasploit module for CVE-2015-1578 , a buffer overflow vulnerability in Achat 0.150 beta7 on Windows. Exploitation leads to remote code execution via a crafted UDP packet. Purpose This module is designed to serve as a clean, minimal, and...

CVE-2024-4577

CVE-2024-4577 - PHP CGI Argument Injection RCE Summary CVE-2024-4577 is a critical PHP CGI argument injection vulnerability that affects Windows systems running PHP in CGI mode. This flaw allows remote attackers to inject arguments into PHP's command line via specially crafted URLs, leading to...

ghostdebug

GhostDebug GhostDebug is a Windows x64 debugger prototype composed of a native debugging DLL and a .NET Framework command-line client. It is intended for debugging targets that use debugger-detection checks. For background on the design, see Developing an undetected debugger on Windows...

MiniPlasma

MiniPlasma After re-investigating the technique used in GreenPlasma specifically SetPolicyVal, it turns out cldflt!HsmOsBlockPlaceholderAccess is still vulnerable to the exact same issue that was reported to Microsoft 6 years ago. I'm not taking full credit for this, James Forshaw from google...

cve-2017-0143

Exploiting CVE-2017-0143 - EternalBlue Vulnerability 📌 Description This project demonstrates how to exploit the CVE-2017-0143 vulnerability EternalBlue in a controlled environment for educational and penetration testing purposes. The attack was performed on a Windows 7 system using Metasploit...

Preproduce-CVE-2019-0232

CVE-2019-0232 - Apache Tomcat CGI Servlet Remote Code Execution This repository provides a Docker-based lab environment to reproduce the CVE-2019-0232 vulnerability in Apache Tomcat 9.0.17 on Windows. Vulnerability Overview CVE-2019-0232 is a remote code execution vulnerability in the Apache Tomc...

CVE-2026-34344

CVE-2026-34344 Information This vulnerability was originally discovered by @angelboy. I reproduced the vulnerability independently for educational and case-study purposes. Microsoft update detail: CVE-2026-34344 PoC has demonstrate crash by Type Confusion vulnerability. However, I don't have any...

presentations

My presentations More things can be found in my personal site: https://sites.google.com/site/zhiniangpeng Exploiting preauth RCE and Sandbox escape vulnerabilities in EXSi, Typhooncon 2023 OLE object are still dangerous today — Exploiting Microsoft Office, POC 2023 Django-Simple-Captcha —...

CVE-2026-42978-PoC-Research

🛡️ CVE-2026-42978-PoC-Research - Find and Fix Windows Security Risks 👋 Welcome to Your Security Companion This application helps you check if your Windows computer has a specific security weakness called CVE-2026-42978. This weakness involves a part of Windows called Push Notifications WpnService...

CVE-2026-41089-Netlogon-RCE-PoC

🛡️ CVE-2026-41089-Netlogon-RCE-PoC - Validate Security Vulnerabilities with Confidence 🔍 What Is This Tool? This is a security research and testing application designed for cybersecurity professionals, IT administrators, and security researchers. It helps you simulate and validate a specific...

PrintNightmare-CVE-2021-34527

PrintNightmare CVE-2021-34527 By now you most probably already heard of the CVE-2021-34527 zero-day vulnerability in all Windows builds since 2003. While there's a fix being pushed by Microsoft, you might still want to restrict devices in your network to be vulnerable. These Intune or Microsoft...

CVE-2019-0708

CVE-2019-0708 Blue Screen PoC Windows 7 64-bit has been tested〜 Command: python crashpoc.py ip 64 https://github.com/n1xbyte/CVE-2019-0708/ Leaving for a wedding tomorrow, if I can't find anything then someone else take the reins Going to drop the crash PoC here Friday if there isnt one public...

SeriousSam

Windows Elevation of Privilege Vulnerability CVE-2021-36934 SeriousSAM Description see MS article: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934 To deploy the workaround via GPO Copy paste the below commands in notepad, save as a batch file .bat extension and then use to pu...

Terminator_Killer

Terminator - Red Team Process Killer A kernel-mode process termination tool leveraging a vulnerable driver CVE-2026-0828 to kill protected processes from user mode. Compilation Requires MinGW-w64 GCC on Windows. Compile with: g++ --% .\terminator.cpp -o terminator.exe -Oz -ffunction-sections...

CrystalPotato

CrystalPotato Crystal port of GodPotato, a local privilege escalation from accounts with SeImpersonatePrivilege to SYSTEM. It works by abusing the DCOM OXID Resolver and named pipe impersonation. Windows APIs are resolved dynamically and invoked through indirect syscall stubs, all strings are...