CVE-2024-21338

CVE-2024-21338 Local Privilege Escalation from Admin to Kernel vulnerability on Windows 10 and Windows 11 operating systems with HVCI enabled. Compiling Use Microsoft Visual Studio with the C++ package to successfully compile the PoC on both Release and Debug modes. Post Original blog post:...

xc

XC Netcat like reverse shell for Linux & Windows. Features Windows Usage: └ Shared Commands: !exit !upload uploads a file to the target !download downloads a file from the target !lfwd local portforwarding like ssh -L !rfwd remote portforwarding like ssh -R !lsfwd lists active forwards !rmfwd...

enum4linux

enum4linux A Linux alternative to enum.exe for enumerating data from Windows and Samba hosts. Enum4linux is a tool for enumerating information from Windows and Samba systems. It attempts to offer similar functionality to enum.exe formerly available from www.bindview.com. It is written in Perl and...

Stryker

Stryker Multi-purpose proof-of-concept tool based on CPU-Z CVE-2017-15303 System Requirements x64 Windows 7/8/8.1/10; Stryker designed only for x64 Windows; Administrative privilege is required. Features Driver Signature Enforcement Overrider similar to DSEFIx; Protected Processes Hijacking via...

VMkatz

VMkatz Too Big to Steal You are three weeks into a red team engagement. You land on a NAS attached to the virtualization cluster — hundreds of gigabytes of .vmdk, .vmsn, .sav sitting right there. But your link does 200 KB/s. Exfiltrating a single 100 GB disk would take six days. VMkatz exists...

PrivKit

PrivKit A collection of Beacon Object Files BOFs for Windows Local Privilege Escalation Checks. Description PrivKit is an open-source tool that empowers red teamers and penetration testers to quickly identify common Windows local privilege escalation vectors using Cobalt Strike Beacon Object File...

Loki

🧙‍♂️ Loki Command & Control Loki is a stage-1 command and control C2 framework written in Node.js, built to script-jack vulnerable Electron apps MITRE ATT&CK T1218.015. Developed for red team operations, Loki enables evasion of security software and bypasses application controls by exploiting...

WindowsProtocolTestSuites

Windows Protocol Test Suites Windows Protocol Test Suites provide interoperability testing against the implementation of Windows open specifications including File Services, Identity Management, Remote Desktop and etc. Originally developed for in-house testing of the Microsoft Open Specifications...

wtf

what the fuzz A distributed, code-coverage guided, cross-platform snapshot-based fuzzer designed for attacking user and or kernel-mode targets running on Microsoft Windows and Linux user-mode experimental!. Overview what the fuzz or wtf is a distributed, code-coverage guided, customizable,...

applepie

applepie, a hypervisor implementation for Bochs Hello! Welcome to applepie! This is a tool designed for fuzzing, introspection, and finding bugs! This is a hypervisor using the Windows Hypervisor Platform API present in recent versions of Windows specifically this was developed and tested on...

rp

rp++: a fast ROP gadget finder for PE/ELF/Mach-O x86/x64/ARM/ARM64 binaries Overview rp++ or rp is a C++ ROP gadget finder for PE/ELF/Mach-O executables and x86/x64/ARM/ARM64 architectures. Finding ROP gadgets To find ROP gadget you need to specify a file with the --file / -f option and use the...

PrintNightmare-LPE

CVE-2021-1675PrintNightmare system shell poc for CVE-2021-1675 Windows Print Spooler Elevation of Privilege credit: Zhiniang Peng @edwardzpeng & Xuefeng Li @lxf02942370 Ref: https://github.com/afwu/PrintNightmare windows 10 windows server 2012 Credit to all researcher who find out this bug...

CVE-2020-1066-EXP

Reference This vulnerability belongs to the Windows CardSpace service that does not properly handle symbolic link objects, leading to a local privilege escalation via arbitrary file replacement. Disclaimer The author's PoC is for research purposes only. If readers use this PoC for other activitie...

pe_to_shellcode

petoshellcode Converts PE so that it can be then injected just like a normal shellcode. At the same time, the output file remains to be a valid PE. Supports both 32 and 64 bit PEs Authors:@hasherezade & @hh86 Objective The goal of this project is to provide a possibility to generate PE files that...

cve-2019-1458_POC

CVE-2019-1458: Going from 'in the wild report' to POC Intro In December Kaspersky published a blogpost about 0day exploit used in the wild1. It piqued my interest because although they described how the exploit was working, they didn't provide any POC in their analysis. This is why I decided to t...

CVE-2020-0796

CVE-2020-0796 Windows SMBv3 LPE Exploit Authors Daniel García Gutiérrez @danigargu Manuel Blanco Parajón @dialluvioso Exploit analysis POC Analysis by SungLin Knownsec 404 Team Writeup+PoC by @ZecOps References https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796...

WEFFLES

WEFFLES WEFFLES is a way to build a fast, free, and effective threat hunting console using Windows Event Forwarding and PowerBI. You can find a full blog post on it at https://aka.ms/weffles but if you're impatient wefsetup.ps1 is the file to start with. Thanks, -Jessica...

awesome-security-hardening

awesome-security-hardening A collection of awesome security hardening guides, best practices, checklists, benchmarks, tools and other resources. This is work in progress: please contribute by sending your suggestions. You may do this by creating issue tickets or forking, editing and sending pull...

Adalanche

Adalanche Open Source Attack Graph Visualizer and Explorer Adalanche gives instant results, showing you what permissions users and groups have in an Active Directory. It is useful for visualizing and exploring who can take over accounts, machines or the entire domain, and can be used to find and...

WinPmem

WinPmem -- a physical memory acquisition tool WinPmem has been the default open source memory acquisition driver for windows for a long time. It used to live in the Rekall project, but has recently been separated into its own repository. This is the Windows version. The Linux version, Linpmem , i...