Titanis

View the User Guide on the documentation site Introduction Titanis is a library of protocol implementations and command line utilities, written in C, for interacting with Windows environments. It uses .NET 8 and is cross-platform Windows and Linux. Some of the protocols implemented: SMB2 MS-SMB2...

easyda

EasyDA - Easy Windows Domain Access Script Easy Windows Domain Access Script Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Daniel Compton, daniel dot compton at nccgroup dot com https://github.com/nccgroup/easyda Released under AGPL see LICENSE for more...

AllTools

AllTools All reasonably stable tools AccessMask - decode access mask for common object types BgInfo - WPF version of the Sysinternals BgInfo tool BITSMgr - BITS jobs manager application CLR Explorer - View .NET process information / dump file CpuStres - thread/CPU stress testing app CpuStress...

CVE-2022-21882

CVE-2022-21882 win32k LPE bypass CVE-2021-1732 only tested on windows 20h2 19042.1415 https://twitter.com/kalendsi/status/1483770845138804738...

VMkatz

VMkatz Too Big to Steal You are three weeks into a red team engagement. You land on a NAS attached to the virtualization cluster — hundreds of gigabytes of .vmdk, .vmsn, .sav sitting right there. But your link does 200 KB/s. Exfiltrating a single 100 GB disk would take six days. VMkatz exists...

attack_monitor

Attack Monitor Attack Monitor is Python application written to enhance security monitoring capabilites of Windows 7/2008 and all later versions workstations/servers and to automate dynamic analysis of malware. Current modes mutually exclusive: Endpoint detection ED Malware analysis on dedicated...

nullmap

nullmap A very simple driver manual mapper based on my older voidmap and CVE-2023-21768 POC by chompie and b33f. Because the underlying IoRing post-exploitation memory r/w primitive is not handling many consequent reads and writes very well, I've decided to overwrite CR4 to disable SMEP/SMAP to...

keebcap

Keebcap This repository contains the code associated to this article in which we talk about building a win32 keylogger that supports all languages not using input method editors. All tests were done on Windows 10 22h2. tree . keylog code ├── capgks.c sample keylogger using GetKeyState ├── capllh....

rp

rp++: a fast ROP gadget finder for PE/ELF/Mach-O x86/x64/ARM/ARM64 binaries Overview rp++ or rp is a C++ ROP gadget finder for PE/ELF/Mach-O executables and x86/x64/ARM/ARM64 architectures. Finding ROP gadgets To find ROP gadget you need to specify a file with the --file / -f option and use the...

pentest-book

description: - This book contains a bunch of info, scripts and knowledge used during my pentests. /home/six2dez/.pentest-book Thanks to visit this site, please consider enhance this book with some awesome tools or techniques you know, you can contact me by Telegram@six2dez, Twitter@six2dez1 or...

CVE-2026-26128

CVE-2026-26128 Python tool to exploit Kerberos reflection via Unicode normalization in Windows Active Directory. Based on research by Guillaume André / Synacktiv. Installation These tools are only compatible with Python 3.8+. Clone the repository from GitHub, install the dependencies and you shou...

PrintNightmare-CVE-2021-34527

PrintNightmare - Windows Print Spooler RCE/LPE Vulnerability CVE-2021-34527, CVE-2021-1675 Summary This is a remote code execution vulnerability that can be used to obtain SYSTEM level privileges by an authenticated remote user against Windows machines running the print spooler service. An attack...

Kernelhub

CVE-2003-0352 Describe Buffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message, as exploited by the Blaster/MSblast/LovSAN and Nachi/Welchia worms. ImpactVersion Product| C...

DefCon25

Lab Setup 1. x2 VM's = Win7 x64 & Win10RS1/2 x64 2. Extract "DefCon-Tool.zip" to the root of the C drive 3. Follow slides and Lab-Writeup.txt...

Windows_LPE_AFD_CVE-2023-21768

CVE-2023-21768 Local Privilege Escalation POC authors: chompie & b33f For demonstration purposes only. Complete exploit works on vulnerable Windows 11 22H2 systems. Write primitive works on all vulnerable systems. Usage: WindowsAFDLPECVE-2023-21768.exe where is the process ID in decimal of the...

PS2EXE

AI free repository - artificial intelligence is killing creativity and our nature! PS2EXE Overworking of the great script of Ingo Karstein with GUI support. The GUI output and input is activated with one switch, real windows executables are generated. Compiles only Powershell 5.x compatible...

fileintel

fileintel This is a tool used to collect various intelligence sources for a given file. Fileintel is written in a modular fashion so new intelligence sources can be easily added. Files are identified by file hash MD5, SHA1, SHA256. The output is in CSV format and sent to STDOUT so the data can be...

Exploits

This repository contains a personal collection of Windows CVE I have turned in to exploit source, as well as a collection of payloads I've written to be used in conjunction with these exploits. Some of these CVE have been joined together in exploit chains for RCE, sandbox escapes and privilege...

CallbackHell

CallbackHell Exploit for CVE-2021-40449 Win32k - LPE CallbackHell Description Technical Writeup PoC References Description CVE-2021-40449 is a use-after-free in Win32k that allows for local privilege escalation. The vulnerability was found in the wild by Kaspersky. The discovered exploit was...

CVE-2020-0787-EXP-ALL-WINDOWS-VERSION

CVE-2020-0787-EXP-ALL-WINDOWS-VERSION Disclaimer The author's PoC is for research purposes only. If readers use this PoC for other actions, the author is not responsible. Introduction CVE-2020-0787-EXP Support ALL Windows Version...