253123 matches found
Z0FCourse_ReverseEngineering
Reverse Engineering Course This course aims to take an individual from beginner to intermediate advanced is really only achieved through experience in reverse engineering. While this course focuses on Windows 64-bit, the technical knowledge applies to 32-bit Windows and the theory to any OS. The...
upx
ooooo ooo ooooooooo. ooooooo ooooo 888' 8' 888 Y88. 8888 d8' 888 8 888 .d88' Y888..8P 888 8 888ooo88P' 8888' 888 8 888 .8PY888. 88. .8' 888 d8' 888b YbodP' o888o o888o o88888o The Ultimate Packer for eXecutables Copyright c 1996-2026 Markus Oberhumer, Laszlo Molnar & John Reiser...
CVE-2026-54107
When ValidateHwnd Isn't a Gate: Root-Causing CVE-2026-54107 A use-after-free in win32kfull.sys window lifecycle management — how I found it, how I convinced myself it was real, and what the MSRC process actually looked like from the researcher's side. It was close to 2 AM when the target VM stopp...
HyperDbg
HyperDbg Debugger HyperDbg Debugger is an open-source, hypervisor-assisted debugger for Windows Linux support is currently under development! with support for both user-mode and kernel-mode native debugging. It is built for reverse engineering, fuzzing, and advanced system analysis using modern...
GodPotato
GodPotato Based on the history of Potato privilege escalation for 6 years, from the beginning of RottenPotato to the end of JuicyPotatoNG, I discovered a new technology by researching DCOM, which enables privilege escalation in Windows 2012 - Windows 2022, now as long as you have...
WhoamiAlternatives
Alternatives to whoami Some experiments to retrieve the current username without calling whoami.exe or similar binaries. Method 1: PRTLUSERPROCESSPARAMETERS Get the environment variables from the PEB structure and parse it to find the username. Function NtQueryInformationProcess returns a...
RegPwnBOF
RegPwn BOF Cobalt Strike BOF port of the RegPwn exploit by Filip Dragovic @Wh04m1001 / MDSec ActiveBreach. This is a sloppy BOF reimplementation of the original C exploit. All credit for the vulnerability research and exploit goes to Filip Dragovic and MDSec. Blog post :...
allthingsida
Operating system MS Windows PEB/LDRDATATABLEENTRY enumeration scripts PEB/TEB structures x64 PEB/TEB structures x86...
WHP
M$ Windows Hacking Pack Tools here are from different sources. The repo is generally licensed with WTFPL, but some content may be not eg. sysinternals. "pes" means "PE Scambled". It's useful sometimes. Remote Exploits Windows 2000 / XP SP1 MS05-039 Microsoft Plug and Play Service Overflow, Works...
CVE-2019-0708-poc
CVE-2019-0708 Big shout out to the Dox King Krebs and also the thief of inventions and all-purpose fraud, Kevin. https://www.youtube.com/watch?v=dQw4w9WgXcQ...
CVE-2023-29343
CVE-2023-29343 This is PoC for arbitrary file write bug in Sysmon version 14.14 After last patch Sysmon would check if Archive directory exists and if it exists it would check if archive directory is owned by NT AUTHORITY\SYSTEM and access is only granted to NT AUTHORITY\SYSTEM. If both condition...
Hollow
Hollow hollow is a shellcode loader generator. You give it a raw shellcode binary and a profile, and it spits out a compiled Windows PE loader with your shellcode encrypted inside. Getting Started Binaries are available on the releases page, or build from source: go build -o hollow . Requires...
ff-password-exporter
FF Password Exporter It can be difficult to export your passwords from Firefox. Since version 57 of Firefox Quantum existing password export addons no longer work. Mozilla provides no other official alternatives. FF Password Exporter makes it quick and easy to export all of your passwords from...
PyNightmare
PyNightmare PoC for CVE-2021-36934 Aka HiveNightmare/SeriousSAM fully written in python3 Explanation CVE-2021-36934 is a recently discovered vulnerability found by @jonasLyk allowing non-admin users to copy all registry hives which contain very private information like hashes which could lead to...
CVE-2022-34715-POC
CVE-2022-34715-POC CVE-2022-34715-POC pcap nfssvr.sys version 10.0.20348.825 0: kd r rax=0000000080000001 rbx=0000000000000000 rcx=ffffde87fe461150 rdx=0000000000000000 rsi=fffff8040811aa50 rdi=0000000000000008 rip=fffff80408067dbb rsp=ffffb400eb3e2630 rbp=ffffb400eb3e26b9 r8=0000001000000020...
Posh-SSH
Posh-SSH Description Windows Powershell module that leverages a custom version of the SSH.NET Library to provide basic SSH functionality in Powershell. The main purpose of the module is to facilitate automating actions against one or multiple SSH enabled Linux servers from a Windows Host. As of...
CVE-2024-36991
CVE-2024-36991 POC for CVE-2024-36991: This exploit will attempt to read Splunk /etc/passwd file. Overview This is a bulk scanning and exploitation tool for CVE-2024-36991: Path traversal that affects Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10. This vulnerability was...
CVE-2020-0668
CVE-2020-0668 Use CVE-2020-0668 to perform an arbitrary privileged file move operation. Use https://github.com/itm4n/UsoDllLoader Windows = 1903 OR https://github.com/xct/diaghub Windows 1903 for privilege escalation. Demo Links & Resources...
ROP_ROCKET
Introducing the ROP ROCKET This new, advanced ROP framework made it debute at at DEF CON 31 with some unprecedented capabilities. ROCKET generates several types of chains, and it provides new patterns or techniques. Please note that this is still a work in progress, with some updated and enhanced...