ShadowSteal

ShadowSteal | CVE-2021-36934 Pure Nim implementation for exploiting CVE-2021-36934, the SeriousSAM Local Privilege Escalation LPE. Not OPSEC safe.... yet ;. I do not claim credit for the discovery of this exploit. Quick Start Build with Docker Getting started with ShadowSteal is now easier than...

ludus-defender-lab

Ludus Defender Lab Ludus range config and Ansible roles for a Windows security lab pre-staged for MDE and MDI, with a fully misconfigured ADCS installation for detection coverage testing. Config| VMs| Purpose ---|---|--- zsec-mde-mdi-lab.yml| DC01 + WKS01| MDE/MDI detection lab with ADCS ESC1–ESC...

Get-log4j-Windows.ps1

Get-log4j-Windows.ps1 Identify all log4j components across all windows servers, entire domain, can be multi domain. CVE-2021-44228 Will scale to 1,000+ windows servers, 250+ servers at a time. 1k servers took about 1 1/2 hours. Apache log4j CVE-2021-44228 Single Server Version: Single Server...

evtx

EVTX A cross-platform parser for the Windows XML EventLog format Features 🔒 Implemented using 100% safe rust - and works on all platforms supported by rust that have stdlib. ⚡ Fast - see benchmarks below. It's faster than any other implementation by orders of magnitude! 🚀 Multi-threaded. ✨ Suppor...

fingerprint

fingerprint Monitoring Registry and File Changes in Windows - forensic analytics for windows registry and files "fingerprint" records the state of a windows system, in terms of files and registry. Such fingerprints can be compared to find all changed data. The data can be narrowed with procmon...

CVE-2026-42980-POC

CVE-2026-42980 Public Disclosure This repository contains the public disclosure material for CVE-2026-42980 , a Windows kernel WMI integer-underflow vulnerability that can be exploited for local privilege escalation to NT AUTHORITY\SYSTEM on vulnerable lab builds. Full write-up English article...

patching

Patching - Interactive Binary Patching for IDA Pro Overview Patching assembly code to change the behavior of an existing program is not uncommon in malware analysis, software reverse engineering, and broader domains of security research. This project extends the popular IDA Pro disassembler to...

MsSettingsDelegateExecute

MsSettingsDelegateExecute Bypass UAC on Windows 10/11 x64 using ms-settings DelegateExecute registry key. This visual studio project will compile a static x64 binary to test this issue. License These files are available under the 3-clause BSD license...

concealed_position

Concealed Position Concealed Position is a local privilege escalation attack against Windows using the concept of "Bring Your Own Vulnerability". Specifically, Concealed Position CP uses the as designed package point and print logic in Windows that allows a low privilege user to stage and install...

CVE-2023-36874_BOF

CVE-2023-36874 Windows Error Reporting LPE BOF Introduction This is a mature and operational CobaltStrike BOF implementation of Filip Dragovic's @filipdragovic CVE-2023-36874 Windows Error Reporting LPE exploit. He did the heavy lifting in terms of creating a working exploit by reversing the...

IPBan

IPBan - Free software to block out attackers quickly and easily on Linux and Windows Helpful Links Get a discount on IPBan Pro by visiting https://ipban.com/upgrade-to-ipban-pro/. Integrate IPBan with IPThreat, a 100% free to use website and service of community submitted bad ip addresses. Help...

CVE-2020-1472

After reproducing, there are some small bugs; it gets stuck on the login screen for a long time after rebooting. Not sure if it's just me. Use cautiously in real environments. In practice, you can use secretsdump.py with the -use-vss and -history options to retrieve historical hashes for recovery...

VEN0m-Ransomware

VEN0m Ransomware https://github.com/user-attachments/assets/5a1fc9b5-a647-41f6-a152-7b9d97381adc This project demonstartes how a legit, and signed driver can be weponized to evade defenses and deploy ransomware simulating a real cyberattack. 🚨 Tested on Windows 11 Pro 24H2. Fully undetectable as ...

CVE-2009-3103---srv2.sys-SMB-Code-Execution-Python-MS09-050-

Microsoft-Windows---srv2.sys-SMB-Code-Execution-Python-MS09-050- Microsoft Windows - 'srv2.sys' SMB Code Execution Python MS09-050 Exploit for CVE-2009-3103 Overview This Python script is an updated version of a public exploit for CVE-2009-3103. The original code relied on the SMB.connection...

CVE-2026-42978-PoC-Research

CVE-2026-42978 PoC & Research — Windows Push Notifications Use-After-Free Race condition in Windows Push Notifications service WpnService that runs as NT AUTHORITY\SYSTEM. An attacker with local access can trigger a use-after-free during platform shutdown and potentially elevate privileges. CVE:...

IRTriage

Incident Response Triage: Scripted collection of system information valuable to a Forensic Analyst. IRTriage will automatically "Run As ADMINISTRATOR" in all Windows versions except WinXP. The original source was Triage-ir v0.851 an Autoit script written by Michael Ahrendt. Unfortunately Michael'...

CVE-2024-36991

CVE-2024-36991 - Splunk Path Traversal Proof of Concept for CVE-2024-36991 which allows an attacker to read arbitrary files in Splunk for versions below to 9.2.2, 9.1.5, and 9.0.10 for Windows. Usage Read Splunk configuration files To read Splunk files just run the script passing the target URL...

SharpToken

SharpToken During red team lateral movement, we often need to steal the permissions of other users. Under the defense of modern EDR, it is difficult for us to use Mimikatz to obtain other user permissions, and if the target user has no process alive, we have no way to use "OpenProcessToken" to...

w11_shadow_copies

Windows 11 Shadow Copies On Windows 11, the built-in vssadmin can list, delete or resize Shadow Copies, but Microsoft removed the ability to create them. However, you can still do it by interacting directly with the Volume Shadow Copy Service VSS API, which I already used in my other tool SAMDump...

wsb-detect

⏳ wsb-detect wsb-detect enables you to detect if you are running in Windows Sandbox "WSB". The sandbox is used by Windows Defender for dynamic analysis, and commonly manually by security analysts and alike. At the tail end of 2019, Microsoft introduced a new feature named Windows Sandbox WSB for...