CVE-2026-50416-writeup-and-poc

CVE-2026-50416: a kernel address in the desktop heap On the affected system, this read from the user mapping of the Win32 desktop heap returned a kernel address: ULONG64 leaked = ULONG64 desktopheap + 0x100; That is the whole disclosure. At first it was only an eight-byte value with convincing hi...

CVE-2024-30051

CVE-2024-30051 — Windows DWM Heap Overflow EoP · Master's Thesis Research -orange Heap-based Buffer Overflow in Windows Desktop Window Manager dwmcore.dll Local Privilege Escalation → Integrity Level SYSTEM via DWM process Build target: Windows 11 22H2 10.0.22621.3447 · Patch: KB5037771 Descripti...

CVE-2023-28252-Compiled-exe

CVE-2023-28252-Compiled-exe A modification of Fortra's excellent CVE-2023-2852 Privesc Exploit. Works on Windows 11 21H2 clfs.sys version 10.0.22000.1574 - also works on Windows 10 21H2, Windows 10 22H2, Windows 11 22H2 and Windows server 2022. This version retains the original functionality, but...

gdid-reversal

Full writeup of the Windows GDID Global Device Identifier fully reverse engineered -8a2be2 -0078d6 How Microsoft's "Global Device Identifier", the persistent Windows fingerprint named in the July 2026 Scattered Spider complaint, is actually generated, stored, and transmitted. TL;DR !NOTE Listed...

CVE-2026-62735

CVE-2026-62735 Information This vulnerability was originally discovered by Siyeon Wi. I reproduced the vulnerability independently for educational and case-study purposes. The vulnerability was also demonstrated at Pwn2Own Berlin 2026. References: TrendAI Zero Day Initiative status TrendAI Zero D...

IoRingReadWritePrimitive

IoRingReadWritePrimitive Post exploitation technique to turn arbitrary kernel write / increment into full read/write primitive on Windows 11 22H2+ This PoC is using the HackSysExtremeVulnerableDriver. The PoC supports both arbitrary write and arbitrary increment, controlled through a flag passed...

appsandbox

App Sandbox App Sandbox is a virtual machine app for Windows and macOS that's focused on performance and ease of use. Windows features: Works on Windows 11 Home or Pro, without Hyper-V Windows 11 or Ubuntu 26.04 LTS VM Support Zero touch install Copy and Paste 2 Channel Audio GPU Acceleration via...

CoercedPotato

Coerced potato From Patate LOCAL/NETWORK SERVICE to SYSTEM by abusing SeImpersonatePrivilege on Windows 10, Windows 11 and Server 2022. For more information: https://blog.hackvens.fr/articles/CoercedPotato.html. A very quick PoooooC: .\CoercedPotato.exe -c whoami An other PoC with an interactive...

CVE-2025-60709

🚨 EXPLOIT PoC — FOR SECURITY RESEARCH, VULNERABILITY ANALYSIS AND DEFENSIVE PURPOSES ONLY 🚨 PoC DE EXPLOIT — SOLO PARA INVESTIGACIÓN DE SEGURIDAD, ANÁLISIS DE VULNERABILIDADES Y FINES DEFENSIVOS 🌐 Idiomas / Languages 🇪🇸 Español 🇬🇧 English 🇪🇸 Documentación en Español Descripción CVE-2025-60709 es...

CVE-2024-38193-Nephster

CVE-2024-38193 Tested on Windows 11 Pro 23H2 22631.3447...

CVE-2023-21768

CVE-2023-21768 Local Privilege Escalation POC authors: chompie & b33f For demonstration purposes only. Complete exploit works on vulnerable Windows 11 22H2 systems. Write primitive works on all vulnerable systems. Usage: WindowsAFDLPECVE-2023-21768.exe where is the process ID in decimal of the...

evtx-baseline

evtx-baseline A repository hosting example goodware evtx logs containing sample software installation and basic user interaction Donations win10-client.tgz by @phantinuss win11-client.tgz by @frack113 win7-x86.tgz by @pH-T win2022-evtx.tgz by @Neo23x0 win2022-ad.tgz by @frack113...

Windows11Exploits

Windows11Exploits...

CVE-2025-24076

CVE-2025-24076 Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability Exploit Overview This script exploits a vulnerability in the Windows Cross Device Service that allows privilege escalation on Windows 11 , Windows Server 2025 , and Windows Server 2022 23H2 Server Core...

VEN0m-Ransomware

VEN0m Ransomware https://github.com/user-attachments/assets/5a1fc9b5-a647-41f6-a152-7b9d97381adc This project demonstartes how a legit, and signed driver can be weponized to evade defenses and deploy ransomware simulating a real cyberattack. 🚨 Tested on Windows 11 Pro 24H2. Fully undetectable as ...

cve-2026-62737-lab

CVE-2026-62737: from crash to lab-assisted SYSTEM A follow-up to the original CVE-2026-62737 writeup ExecutionContext.sys arbitrary kernel indirect call. It turns the crash PoC into a working token-swap chain that spawns cmd.exe as SYSTEM, but only in a lab where a debugger supplies addresses and...

CVE-2022-37969

CVE-2022-37969 Windows Local Privilege Escalation PoC authors: Ricardo Narvaja & Daniel Kazimirow Solid For demonstration purposes only. Complete exploit works on vulnerable Windows 11 21H2 systems. Functional PoC based on previously published information by Zscaler Checkout the writeup...

CVE-2025-5548

🛡️ Analysis and Exploitation: CVE-2025-5548 Master in Cybersecurity | Module 6: Vulnerabilities 👋 Hello! Welcome to my Analysis Workshop In this repository I document my practical immersion in binary-level vulnerability analysis and the development of exploits for Windows environments. The main...

Nidhogg

Nidhogg Nidhogg is a multi-functional rootkit to showcase the variety of operations that can be done from kernel space. The goal of Nidhogg is to provide an all-in-one and easy-to-use rootkit with multiple helpful functionalities for operations. Besides that, it can also easily be integrated with...

Eneio64-LPE

Opens a handle to the vulnerable driver 2. Maps physical memory into userspace 3. Opens a handle to the System process 4. Queries the SystemHandleInformation table of the current process for the obatined system handle leaking its EPROCESS address. 5. Walks System EPROCESS ActiveProcessLinks...