fingerprint

fingerprint Monitoring Registry and File Changes in Windows - forensic analytics for windows registry and files "fingerprint" records the state of a windows system, in terms of files and registry. Such fingerprints can be compared to find all changed data. The data can be narrowed with procmon...

go-secdump

go-secdump Description Package go-secdump is a tool built to remotely extract hashes from the SAM registry hive as well as LSA secrets and cached hashes from the SECURITY hive without any remote agent and without touching disk. The tool is built on top of the library go-smb and use it to...

DecryptTeamViewer

DecryptTeamViewer Uses CVE-2019-18988 to enumerate and decrypt TeamViewer credentials from Windows registry. Vulnerability research done by Nic Losby. Blogpost detailing the vulnerability: https://whynotsecurity.com/blog/teamviewer/ Usage .\DecryptTeamViewer.exe...

Reg1c1de

Reg1c1de: Windows Registry Privesc Scanner Summary from help output: Reg1c1de is a tool that scans specified registry hives and reports on any keys where the user has write permissions In addition, if any registry values are found that contain file paths with certain file extensions and they are...

LAB-DFIR-cve-2023-38831

LAB-DFIR-cve-2023-38831 This lab simulates a CVE-2023–38831 attack and must investigate diskimage and contains a variety of questions including understanding the Windows registry, NTFS files, cache browser, and a complete understanding of the functions that come out of Windows in the sequence of...

RegPwn

🛠️ RegPwn - Windows 로컬 권한 상승 익스플로잇 도구 RegPwn은 Windows 시스템에서 로컬 권한 상승LPE 익스플로잇을 시연하기 위해 설계된 도구입니다. Windows 10, Windows 11 및 Windows Server 버전에서 작동합니다. 이 가이드는 RegPwn을 Windows 컴퓨터에 안전하고 효과적으로 다운로드, 준비 및 실행하는 데 도움을 줍니다. 📋 시작하기 전에 필요한 것 RegPwn을 다운로드하기 전에 시스템이 다음 조건을 충족하는지 확인하십시오. 지원되는 Windows 버전 중 하나를...

mscache

mscache a tool to manipulate dccdomain cached credentials in windows registry, based mainly on the work of mimikatz and impacket requirements python2 pycrypto passlib impacket example root@kitploit: python mscache.py --security security --system system dumping domain cached credentials reg query...

MEC

가짜 확장자 제어 MEC 가짜 확장자 제어MEC는 Windows가 파일을 열 때 확장자뿐만 아니라 매직 넘버에 의존하도록 하는 프로그램입니다. 이는 시스템을 훨씬 더 안전하게 만듭니다. 많은 공격이 확장자를 속이고 파일이 실제로 열려야 하는 프로그램 대신 취약한 프로그램으로 열리거나 실행되도록 하려고 시도하기 때문입니다. 개발자 모드 자세한 내용은 https://mec.e-paths.com 을 참조하십시오. 가짜 확장자를 이용한 공격 방지 공격자는 보통 파일의 확장자를 변경하여 사용자가 파일을 신뢰하도록 만듭니다. 이는...

cve-2017-8529

cve-2017-8529 My CVE-2017-8529 files A PowerShell script to configure the registry fix in CVE-2017-8529...

CVE-2026-69337

Double free in Windows Registry allows an authorized attacker to elevate privileges over a network...

CVE-2026-69337

A double free vulnerability in the Windows Registry allows an authorized attacker to elevate privileges over a network . The flaw requires low privileges and user interaction , with high attack complexity , but results in high impact to confidentiality, integrity, and availability (CVSS 3.1 score...

EUVD-2026-73222

Double free in Windows Registry allows an authorized attacker to elevate privileges over a network...

Windows Registry Elevation of Privilege Vulnerability

Double free in Windows Registry allows an authorized attacker to elevate privileges over a network...

CVE-2024-4573-Mitigation-Script

CVE-2024-4573-Mitigation-Script CVE-2024-43451 — это уязвимость в системах, допускающих аутентификацию NTLM, устаревшего протокола, который может быть использован для атак с перехватом учётных данных или атак методом полного перебора. Эта уязвимость возникает при включённом NTLM, что делает систе...

MAL-2026-4348 Malicious code in api-rs-node (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

MAL-2026-4349 Malicious code in clob.api (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

Malicious code in get-package-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 383f22ab2e1e8bbb44a44fa3828710f476947837d0b38aa9266eafcbf9959261 Package name typosquats the popular get-package-type and reuses its README/exports verbatim, but adds "postinstall": "node utils.cjs" in package.json...

Windows Registry Privilege Escalation Scanner / Audit Tool

This PowerShell script is a defensive security auditing tool designed to inspect Windows registry areas commonly associated with privilege escalation EoP techniques and system misconfigurations...

Electron 注入漏洞

Electron is an open-source JavaScript framework developed by users for creating cross-platform desktop applications. This framework is based on Node.js and Chromium, allowing the development of cross-platform desktop applications using HTML and CSS. Versions of Electron prior to 38.8.6, 39.8.1,...

Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

Impact On Windows, app.setAsDefaultProtocolClientprotocol did not validate the protocol name before writing to the registry. Apps that pass untrusted input as the protocol name may allow an attacker to write to arbitrary subkeys under HKCU\Software\Classes, potentially hijacking existing protocol...