cve-2020-1350

This is a powershell script that'll grab all the AD servers for the domain your computer is on. It'll then set the CVE 2020-1350 DNS workaround on those servers and restart DNS. NOTE!! it will restart DNS so you might need a maintenance window to run it. This workaround does not mean that you can...

AtlasC2

AtlasC2 C C2 Framework centered around Stage 1 operations Atlas is based around gaining a foothold within an environment and further utilizing it to smuggle in C currently strictly C weaponry utilizing an HTTP based implant. Isn't exactly very OPSEC safe in it's current state...at all. Currently...

Cve-2022-26809

Cve-2022-26809 CVE-2022-26809 This repo just simply research for the CVE, for more detailed ananlysis,please refer here. UPDATE:05/19 2022 This ananlyze hasn't been finished yet.... UPDATE:05/22 2022 HuanGMz Post and corelight blog show the real vulnerable point:...

Harden-Windows-Security

Harden Windows Security | A New Threat to Malware Harden Windows Safely, Securely, Only With Official Microsoft Methods How To Use Related Trust Support Security Recommendations Resources License Wiki Basic FAQs Roadmap Donation !IMPORTANT Here are Quick Access Points to Important Sections of thi...

DLHell

DLHell DLHell performs DCOM local & remote Windows DLL Proxying. Install The following packages are required might depend on your distro, the following example is for Debian 12: sudo apt install -y g++-mingw-w64-x86-64-win32 binutils-mingw-w64-x86-64 Install pip dependencies: pip3 install -r...

SMBGhost_AutomateExploitation

SMBGhost CVE-2020-0796 Automate Exploitation and Detection This python program is a wrapper from the RCE SMBGhost vulnerability. All the credits for the working exploit to chompie1337. All the credits for the scanner to ioncodes. I just automate these functions in one program. You need to have in...

ShieldBreak

ShieldBreak - Windows Defender 0day vulnerability Microsoft has failed to properly patch the RoguePlanet vulnerability CVE-2026-50656, this PoC demonstrates a full patch bypass. The PoC was tested in the latest version of windows 11 25h2 +Canary channel and windows server 2025, the PoC also have ...

CVE-2026-62737

CVE-2026-62737 — ExecutionContext.sys Arbitrary Kernel Call Proof of concept for CVE-2026-62737: ExecutionContext.sys invokes a user-controlled TaskFn pointer in kernel mode without validation, producing a controlled kernel crash. Validated on stock Windows 11 25H2 build 26200.8655, ARM64: 0x7E...

CVE-2015-1578-PoC-Metasploit

CVE-2015-1578 Metasploit Module Overview This is a Metasploit module for CVE-2015-1578 , a buffer overflow vulnerability in Achat 0.150 beta7 on Windows. Exploitation leads to remote code execution via a crafted UDP packet. Purpose This module is designed to serve as a clean, minimal, and...

BYOVD-Research

Overview This is an older driver that was recently exploited in a BYOVD campaign detailed here: https://www.bleepingcomputer.com/news/security/edr-killer-tool-uses-signed-kernel-driver-from-forensic-software/ The exploit path is as follows: 1. The attacker's program runs as admin and gets its own...

Peyara-FileUpload

Exploit Title: Peyara Remote Mouse v1.0.1 Unauthenticated Arbitrary File Upload Date: 2025-01-06 Exploit Author: tmrswrr Software Link: https://peyara-remote-mouse.vercel.app/ Platform: Windows Version: v1.0.1 Tested on: Windows 10 USAGE : python3 combinedscript.py Create Malicious LNK File...

CVE-2026-26119

CVE-2026-26119 WAC RCE - CVE-2026-26119 Windows Admin Center authenticated RCE via WinREST/PowerShell invokeCommand. Usage: python3 wacrce.py "" WACPASS= python3 wacrce.py Env: WACBASE - override target base URL default below WACPASS - password, used if not passed positionally...

CVE-2025-50168-pwn2own-berlin-2025

Author: D4m0n CVE-2025-50168 This is an exploit submitted to Pwn2Own Berlin 2025 - LPE Category. The vulnerability occurs in Win32kbase!DirectComposition, and further details can be found in the blog post. Acknowledgements kASLR bypass technique: prefetch-tool by carrotc4k3 Special thanks to: Dav...

backup_dc_registry

Backup Operator Registry Backup to Domain Compromise A simple POC that abuses Backup Operator privileges to remote dump SAM, SYSTEM, and SECURITY hives. Research credit to: @filipdragovic Ported from @mpgn Windows PoC Usage This proof of concept is a modified version of impacket/examples/reg.py a...

InjectProc

InjectProc Process injection is a very popular method to hide malicious behavior of code and are heavily used by malware authors. There are several techniques, which are commonly used: DLL injection, process replacement a.k.a process hollowing, hook injection and APC injection. Most of them use...

SeriousSam

SeriousSam HiveNightmare a.k.a. SeriousSam Local Privilege Escalation in Windows – CVE-2021-36934...

hashmuncher

Hash Muncher Grab NetNTLMv2 hashes using ETW with administrative rights on Windows Requires elevated administrator access on Windows 8.1 / Windows 2016 or later Uses Event Tracing for Windows ETW to get access to raw packet data for SMB authentication packets Decodes NTLM message types 2 and 3...

lupo

For instructions on how to use Lupo, visit https://github.com/malienist/lupo/wiki/Lupo-Wiki Lupo — Malware IOC Extractor Debugging module for Malware Analysis Automation For a step by step post on how to use Lupo, with images and instructions, please see this post:...

Lilith

Lilith Free & Native Open Source C++ Remote Administration Tool for Windows Lilith is a console-based ultra light-weight RAT developed in C++. It features a straight-forward set of commands that allows for near complete control of a machine. Disclaimer The use of this software on any device that ...

windows_hardening

HardeningKitty and Windows Hardening Introduction The project started as a simple hardening list for Windows 10. After some time, HardeningKitty was created to simplify the hardening of Windows. Now, HardeningKitty supports guidelines from Microsoft, CIS Benchmarks, DoD STIG and BSI SiSyPHuS Win1...