CVE-2024-4573-Mitigation-Script

Script di Mitigazione CVE-2024-4573 CVE-2024-43451 è una vulnerabilità nei sistemi che permettono l'autenticazione NTLM, un protocollo legacy che può essere sfruttato per attacchi di relay di credenziali o attacchi di forza bruta. Questa vulnerabilità si presenta quando NTLM è abilitato, lasciand...

go-secdump

go-secdump Description Package go-secdump is a tool built to remotely extract hashes from the SAM registry hive as well as LSA secrets and cached hashes from the SECURITY hive without any remote agent and without touching disk. The tool is built on top of the library go-smb and use it to...

DecryptTeamViewer

DecryptTeamViewer Usa CVE-2019-18988 para enumerar e descriptografar credenciais do TeamViewer do registro do Windows. Pesquisa de vulnerabilidade feita por Nic Losby. Postagem no blog detalhando a vulnerabilidade: https://whynotsecurity.com/blog/teamviewer/ Uso .\DecryptTeamViewer.exe...

LAB-DFIR-cve-2023-38831

LAB-DFIR-cve-2023-38831 Questo lab simula un attacco CVE-2023–38831 e richiede di investigare sull'immagine del disco; contiene inoltre una serie di domande tra cui la comprensione del registro di Windows, dei file NTFS, della cache del browser e una comprensione completa delle funzioni che...

cve-2017-8529

cve-2017-8529 Meus arquivos CVE-2017-8529 Um script PowerShell para configurar a correção do registro no CVE-2017-8529...

MEC

Masked Extension Control MEC Masked Extension Control MEC è un programma che fa sì che Windows si affidi ai numeri magici, e non solo alle estensioni, per scegliere il programma che verrà utilizzato per aprire il file. Questo è molto più sicuro per il tuo sistema, poiché molti attacchi iniziano...

Reg1c1de

Reg1c1de: Windows Registry Privesc Scanner Zusammenfassung aus der Hilfeausgabe: Reg1c1de ist ein Tool, das angegebene Registry-Hives scannt und über alle Schlüssel berichtet, bei denen der Benutzer Schreibberechtigungen hat. Zusätzlich werden Registry-Werte gemeldet, die Dateipfade mit bestimmte...

mscache

mscache uno strumento per manipolare le credenziali della cache di dominio DCC nel registro di Windows, basato principalmente sul lavoro di mimikatz e impacket requisiti python2 pycrypto passlib impacket esempio root@kitploit: python mscache.py --security security --system system dumping domain...

RegPwn

🛠️ RegPwn - Strumento di Exploit Locale per Windows RegPwn è uno strumento progettato per dimostrare un exploit di escalation dei privilegi locali LPE sui sistemi Windows. Funziona su Windows 10, Windows 11 e versioni di Windows Server. Questa guida ti aiuterà a scaricare, preparare ed eseguire...

fingerprint

fingerprint Monitoraggio delle modifiche al Registro e ai File in Windows - analisi forense per registro e file di Windows "fingerprint" registra lo stato di un sistema Windows in termini di file e registro. Tali impronte possono essere confrontate per trovare tutti i dati modificati. I dati...

MAL-2026-4348 Malicious code in api-rs-node (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

MAL-2026-4349 Malicious code in clob.api (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

Malicious code in get-package-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 383f22ab2e1e8bbb44a44fa3828710f476947837d0b38aa9266eafcbf9959261 Package name typosquats the popular get-package-type and reuses its README/exports verbatim, but adds "postinstall": "node utils.cjs" in package.json...

Windows Registry Privilege Escalation Scanner / Audit Tool

This PowerShell script is a defensive security auditing tool designed to inspect Windows registry areas commonly associated with privilege escalation EoP techniques and system misconfigurations...

Electron 注入漏洞

Electron is an open-source JavaScript framework developed by users for creating cross-platform desktop applications. This framework is based on Node.js and Chromium, allowing the development of cross-platform desktop applications using HTML and CSS. Versions of Electron prior to 38.8.6, 39.8.1,...

Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

Impact On Windows, app.setAsDefaultProtocolClientprotocol did not validate the protocol name before writing to the registry. Apps that pass untrusted input as the protocol name may allow an attacker to write to arbitrary subkeys under HKCU\Software\Classes, potentially hijacking existing protocol...

Microsoft Windows Registry Editor Version 5.00 Malicious Registry File Generator

This script generates a malicious Windows Registration Entries .reg file designed to establish persistence on Windows systems. It creates a registry file that, when executed by a user, adds the attacker's payload to Windows auto-run registry keys. Written in PHP...

Dust Specter Targets Iraqi Officials with New SPLITDROP and GHOSTFORM Malware

A suspected Iran-nexus threat actor has been attributed to a campaign targeting government officials in Iraq by impersonating the country's Ministry of Foreign Affairs to deliver a set of never-before-seen malware. Zscaler ThreatLabz, which observed the activity in January 2026, is tracking the...

Windows Registry Active Setup Persistence

This Metasploit module will register a payload to run via the Active Setup mechanism in Windows. Active Setup is a Windows feature that runs once per user at login. It triggers in a user context, losing privileges from admin to user...

Windows Registry Run Persistence

This Metasploit module is a Windows persistence module designed to maintain access to a compromised system after a successful exploitation and an active Meterpreter session has been obtained...