Lucene search
+L

97 matches found

Kitploit
Kitploit
added 2026/09/15 10:26 a.m.7 views

PS-CVE-2021-21551

Description Script to patch your domain computers about the CVE-2021-21551. Privesc on machines that have the driver dbutil23.sys, installed by some DELL tools BIOS updater, SupportAssist.... It uses WinRM to invoke the checks on every domain-member computers. Tries to clean the vulnerable driver...

8.8CVSS7.9AI score0.79249EPSS
SaveExploits18
Kitploit
Kitploit
added 2026/09/15 10:21 a.m.11 views

evil-winrm

Evil-WinRM...

5.9AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/15 10:09 a.m.5 views

doublehop

Doublehop This tool aims to assist in using PowerShell Remoting / WinRM to execute PowerShell commands on remote hosts through WinRM double hop technique. This tool assumes you have internal network and CLI access. Usage root@kitploit: doublehop Usage: -c string Command we are executing. -j strin...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/15 8:24 a.m.7 views

nimrm

nimrm Native WinRM shell client written in Nim Version 1.2.0 · Author Chokri Hammedi blue0x1 · License MIT...

5.9AI score
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/15 6:45 a.m.10 views

CVE-2025-33073

CVE-2025-33073 Reflection Relay PoC Universal exploitation tool for CVE-2025-33073 targeting Windows Domain Controllers with DNSAdmins privileges and WinRM enabled. 📋 Overview CVE-2025-33073 is a critical vulnerability that allows attackers to achieve SYSTEM-level code execution on Windows Domain...

8.8CVSS8.1AI score0.82699EPSS
SaveExploits7References3
Kitploit
Kitploit
added 2026/09/15 5:45 a.m.11 views

LACheck

LACheck Multithreaded C .NET Assembly Local Administrative Privilege Enumeration Arguments root@kitploit: ./LACheck.exe help | | /\ / | | | | | | / \ | | | | | | | | / /\ \ | | | ' \ / / | |/ / | | / \ | || | | | / | |// \ || |||||\ Usage: LACheck.exe smb rpc...

6AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/15 3:03 a.m.5 views

CVE-2021-31166

CVE-2021-31166 Description - POC for CVE-2021-31166: Windows HTTP协议栈远程代码执行漏洞 - create by antx at 2021-09-27. Detail - ./trigger.gifPoc-Gif CVE Severity - attackComplexity: LOW - attackVector: NETWORK - availabilityImpact: HIGH - confidentialityImpact: HIGH - integrityImpact: HIGH -...

9.8CVSS7.9AI score0.99772EPSS
SaveExploits24
Kitploit
Kitploit
added 2026/09/15 12:34 a.m.10 views

WSMan-WinRM

WSMan-WinRM A collection of proof-of-concept source code and scripts for executing remote commands over WinRM using the WSMan.Automation COM object. Background For background information, please refer to the following blog post: WS-Management COM: Another Approach for WinRM Lateral Movement Notes...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/14 10:09 p.m.10 views

PeekABoo

PeekABoo PeekABoo tool can be used during internal penetration testing when a user needs to enable Remote Desktop on the targeted machine. It uses PowerShell remoting to perform this task. The tool only works if WinRM is enabled. Since Windows Server 2012 WinRM is enabled by default on all Window...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/14 8:06 p.m.9 views

CVE-2020-1472

CVE-2020-1472 CVE 2020-1472 Script de validación Assumption: WinRM is enabled between domain controllers. Required permissions: root@kitploit: If child domains are present: Enterprise admin If single forest, single domain: Domain admin This script must be run on a primary domain controller with...

10CVSS7.5AI score0.99389EPSS
SaveExploits76
Kitploit
Kitploit
added 2026/09/14 4:24 p.m.7 views

EntraPassTheCert

EntraPassTheCert EntraPassTheCert es una herramienta de post-explotación que permite a los atacantes solicitar el certificado P2P de usuario de Entra ID y autenticarse con él en una máquina remota unida a Entra. root@kitploit: $ python3 entraptc.py -h usage: entraptc.py -h --debug...

6AI score
SaveExploits0References5
Kitploit
Kitploit
added 2026/09/14 2:48 p.m.54 views

nosferatu

nosferatu Windows NTLM/Kerberos Authentication Backdoor How it Works First, the DLL is injected into the lsass.exe process, and will begin hooking authentication WinAPI calls. The targeted functions are: NTLM: NtlmShared!MsvpPasswordValidate Kerberos: cryptdll!CDLocateCSystem Kerberos:...

5.5AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/14 2:29 p.m.9 views

ZeroLogon-to-Shell

This is a combination of the zerologontester.py code and the tool evil-winrm to get a shell. I just added a "os.system" to use evil-winrm. Requirements: To get the Administrator NTLM HASH I recommend you to use secretsdump tool from impacket And, of course, you need to install evil-winrm This is...

10CVSS7.4AI score0.99389EPSS
SaveExploits76References2
Kitploit
Kitploit
added 2026/09/14 12:00 p.m.4 views

Kitsune

Kitsune Kitsune is a Polymorphic Command & Control. This tool allows you to get a graphical version of your favourite hacking tools, such as NetExec, Villain or Evil-WinRM among others. In addition, brings many improvements such as automatic reconnection, reports, history and some extra functions...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/14 11:33 a.m.10 views

RogueWinRM

RogueWinRM RogueWinRM is a local privilege escalation exploit that allows to escalate from a Service account with SeImpersonatePrivilege to Local System account if WinRM service is not running default on Win10 but NOT on Windows Server 2019. Briefly, it will listen for incoming connection on port...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/14 10:55 a.m.10 views

RemotePSpy

RemotePSpy RemotePSpy provides live monitoring of remote PowerShell sessions, which is particularly useful for older pre-5.0 versions of PowerShell which do not have comprehensive logging facilities built in. It uses Event Tracing for Windows ETW to obtain message data from the WinRM protocol tha...

6AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/11 5:06 p.m.10 views

CVE-2024-30088__Windows-TOCTOU-exploit

CVE-2024-30088 – PoC adaptado para WinRM 📌 Resumen Esta es una versión modificada del exploit original CVE-2024-30088, adaptada para funcionar en entornos no interactivos WinRM. El PoC original inicia un cmd.exe interactivo, que no funciona a través de WinRM. Esta versión se centra en la ejecució...

7CVSS7.8AI score0.68202EPSS
SaveExploits7
Kitploit
Kitploit
added 2026/09/08 6:08 p.m.6 views

CVE-2021-31166-detection-rules

CVE-2021-31166 Detection Rules Different rules to detect if CVE-2021-31166 is being exploited Rules available: Suricata Snort The snort rules also work on suricata. Zeek To Do: Make PCAPs available which where used during the development of the signatures Zeek script Detection when the...

9.8CVSS8.1AI score0.99772EPSS
SaveExploits24
NVD
NVD
added 2026/06/17 8:17 p.m.41 views

CVE-2026-55201

Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the downloaddir function that allows a rogue or compromised remote Windows server to write files outside the intended download directory by returning filenames with traversal sequences from Get-ChildItem...

7.4CVSS0.00304EPSS
SaveExploits0References3
CVE
CVE
added 2026/06/17 7:08 p.m.48 views

CVE-2026-55201

CVE-2026-55201 affects Evil-WinRM (up to version 3.9). A path traversal in download_dir() can cause the server to generate filenames with traversal sequences from Get-ChildItem output, which are passed unsanitized to File.join(), enabling writes outside the intended download directory. Attackers ...

7.4CVSS5.5AI score0.00304EPSS
SaveExploits0References3
Rows per page
Query Builder