CVE-2017-0144---EtneralBlue-MS17-010-Remote-Code-Execution

CVE-2017-0144---EtneralBlue-MS17-010-Remote-Code-Execution The attacker machine is Kali Linux and Windows Server 2008 R2 as the target machine. Import the windows 2008 R2 Server from the given https://drive.google.com/drive/folders/146ViggeQl0pSpzotcAhpd3h9UP7fFOxJ?usp=sharing into your virtual b...

laZzzy

laZzzy laZzzy is a shellcode loader that demonstrates different execution techniques commonly employed by malware. laZzzy was developed using different open-source header-only libraries. Features Direct syscalls and native Nt functions not all functions but most Import Address Table IAT evasion...

PULSE-C2

PULSE C2 Framework HTTPS Command & Control infrastructure with web dashboard for remote Windows agent management. ⚠️ Educational Use Only - Illegal use = your responsibility. Features HTTPS C2 server with TLS encryption Flask Real-time web dashboard XOR + Base64 encrypted protocol SQLite database...

PhantomFS

Fake Files. Real Security. Virtual honeypot file system for Windows — lure attackers into a directory that looks real, then catch them in the act. What Is PhantomFS? PhantomFS uses the Windows Projected File System ProjFS to surface a virtual directory full of convincing decoy files — financial...

RsWindowsThingies

RsWindowsThingies Windows Thingies... but in Rust Tools listenmft Watch an entries' values change. listenmft 0.2.0 Matthew Seyer See the differences in MFT attirbues. USAGE: listenmft.exe OPTIONS FLAGS: -h, --help Prints help information -V, --version Prints version information OPTIONS: -d, --deb...

maps_scanner

MAPS Cloud Scanner A research tool for interacting with Windows Defender's MAPS Microsoft Active Protection Service cloud-based file reputation and dynamic signature delivery system. MAPS is the cloud backend that powers Defender's real-time protection verdicts, sample submission pipeline, and...

CVE-2023-23192

CVE-2023-23192 CVE-2023-23192- Userlock - Multi-Factor Authentication MFA Bypass Exploit Title: Userlock - Multi-Factor Authentication MFA Bypass Date: 01/11/2023 Exploit Author: Pinar Sadioglu Vendor Homepage: https://www.isdecisions.com/products/userlock/help/ Version: = 11.0.1.40 Tested on:...

staged-DLL-Injection-SMB-

staged-DLL-Injection Staged DLL injection proof-of-concept built in C using Win32 APIs — developed in an isolated lab environment for red team certification study CRTO. ⚠️ Disclaimer: This project was developed strictly in an isolated lab environment for educational purposes as part of offensive...

ludus-defender-lab

Ludus Defender Lab Ludus range config and Ansible roles for a Windows security lab pre-staged for MDE and MDI, with a fully misconfigured ADCS installation for detection coverage testing. Config| VMs| Purpose ---|---|--- zsec-mde-mdi-lab.yml| DC01 + WKS01| MDE/MDI detection lab with ADCS ESC1–ESC...

fingerprint

fingerprint Monitoring Registry and File Changes in Windows - forensic analytics for windows registry and files "fingerprint" records the state of a windows system, in terms of files and registry. Such fingerprints can be compared to find all changed data. The data can be narrowed with procmon...

cve-2020-0796-scanner

cve-2020-0796-scanner This project is base on SMBGhost which is used for scanning CVE-2020-0796 - SMBv3 RCE vulnerability. only add batch scanning function. Usage python3 cve-2020-0796-scanner.py -t Workarounds Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameter...

REW-sploit

REW-sploit Need help in analyzing Windows shellcode or attack coming from Metasploit Framework or Cobalt Strike or may be also other malicious or obfuscated code? Do you need to automate tasks with simple scripting? Do you want help to decrypt MSF generated traffic by extracting keys from payload...

ansvif

ansvif A Not So Very Intelligent Fuzzer Marshall Whittaker oxagast [email protected] As the complexity of a system rises, as does the potential for problems within that system. --Whittaker's Law Compile Dependancies: automake autoconf-archive zlib1g-dev g++ gcc and libgtk2.0-dev if you want...

ida-efitools2

About It is an IDA plugin for extending UEFI reverse engineering capabilities. Based on ida-efitools with a bunch of fixes and new features. Works with both Python 2 and Python 3. Supports outdated versions of IDA Pro 7.x with no guarantees. Features GUIDs defining Structures propagating register...

CVE-2026-42978-PoC-Research

CVE-2026-42978 PoC & Research — Windows Push Notifications Use-After-Free Race condition in Windows Push Notifications service WpnService that runs as NT AUTHORITY\SYSTEM. An attacker with local access can trigger a use-after-free during platform shutdown and potentially elevate privileges. CVE:...

impersonate-rs

IRS Impersonate-RS 💡 IRS is a library version of https://github.com/zblurx/impersonate-rs, zblurx Reimplementation of Defte Impersonate in plain Rust. For more informations about it, see this blogpost. The token impersonation approach is a bit different from Defte Impersonate : here you have to...

SMB-Session-Spoofing

/ | / || \ / | / | / | \ --.| . . || |/ / \ --. \ --. | | --. \ |/| || \ --. / / / | |/ | ' \ --. \ ' \ / \ / | / \ '| // / | | || |/ / // / /\ \ \ | | | | | // / | | | | || / | /| |// / ||//|/|| || /| ./ / /|| || | | || Welcome! This is a utility that can be compiled with Visual...

CVE-2022-26809

CVE description CVE-2022-26809 - weakness in a core Windows component RPC earned a CVSS score of 9.8 not without a reason, as the attack does not require authentication and can be executed remotely over a network, and can result in remote code execution RCE with the privileges of the RPC service,...

ProcessHider

ProcessHider Created by M00nRise IMPORTANT NOTE This tools is allowed to use only for penetration testing and other white-hat activities. Illegal use is absoloutly frobidden! About ProcessHider is a post-exploitation tool designed to hide processes from monitoring tools such as Task Manager and...

Process-Dump

Process Dump Process Dump is a Windows reverse-engineering command-line tool to dump malware memory components back to disk for analysis. Often malware files are packed and obfuscated before they are executed in order to avoid AV scanners, however when these files are executed they will often...