PrivFu

PrivFu Kernel mode WinDbg extension and PoCs for testing how token privileges work. There are notable repository and articles about token privilege abuse such Grzegorz Tworek's Priv2Admin. Codes in this repository are intended to help investigate how token privileges work. Table Of Contents PrivF...

bLaCk-eye-RSA-Attacking-Toolkit-v0.1f-compiled

bLaCk-eye RSA Attacking Toolkit v0.1f Description RAT v0.1f compiled for Windows Since from the official site you can only download source and no executable. If you don't have time to waste with the compiler and miracl library this is ready to go...

windbg-mcp

WinDbg MCP An MCP Model Context Protocol server that exposes every pybag Windows debugger function as a native MCP tool. It gives any MCP-compatible client Claude Desktop, Claude Code, Cowork, OpenAI Codex CLI, Cursor, and custom agents full control over user-mode processes, kernel sessions, and...

frida-extract

FridaExtract FridaExtract is a Frida.re based RunPE extraction tool. RunPE type injection is a common technique used by malware to hide code within another process. It also happens to be the final stage in a lot of packers : NOTE: Frida now also supports extraction of injected PE files using the...

Compiled-PoC-Binary-For-CVE-2023-28252

Compiled PoC Binary For CVE-2023-28252 The repo contains a precompiled binary which can be run on a Windows machine vulnerable to CVE-2023-28252 The precompiled binary is a slightly modified version of the PoC exploit seen in fortra's repo. The file can be run with the following arguments:...

domi-owned

Domi-Owned Summary Domi-Owned is a tool used for compromising IBM/Lotus Domino servers. Tested on IBM/Lotus Domino 8.5.2, 8.5.3, 9.0.0, and 9.0.1 running on Windows and Linux. Requirements Domi-Owned uses Python 3, which can be install through your distribution's package manager apt, yum, etc...

WindowsRootkitsGuide

This repository does not have a README...

MsSettingsDelegateExecute

MsSettingsDelegateExecute Bypass UAC on Windows 10/11 x64 using ms-settings DelegateExecute registry key. This visual studio project will compile a static x64 binary to test this issue. License These files are available under the 3-clause BSD license...

LnkMeMaybe

LnkMeMaybe A .NET 8 toolkit for creating and analysing Windows Shell Link .lnk files. Includes a command-line builder LnkMeMaybe and a graphical editor LnkUi. Intended for security research and penetration testing. Projects Project| Description ---|--- Lnk/| Core library. Parses and generates .ln...

CVE-2026-20817

CVE-2026-20817 - Windows Error Reporting WER ALPC Privilege Escalation Description This repository contains a Proof-of-Concept PoC for CVE-2026-20817 , a local privilege escalation vulnerability in the Windows Error Reporting WER service. The vulnerability allows an authenticated low-privileged...

CVE-2020-0796

CVE-2020-0796 Windows SMBv3 LPE Exploit Authors Daniel García Gutiérrez @danigargu Manuel Blanco Parajón @dialluvioso Exploit analysis POC Analysis by SungLin Knownsec 404 Team Writeup+PoC by @ZecOps References https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796...

MS17-010

MS17-010 As all of our research is now in Metasploit master repository, there was no reason to confuse everyone by keeping this repository open as there were two versions of everything and due to overwhelming popularity support became a nightmare as this is merely a side project. Please do not ma...

cuckoo3

Cuckoo3 - Malware analysis tool About Cuckoo3 is an open-source tool to test suspicious files or links in a controlled environment. It will test them in a sandboxed platform emulators and generate a report, showing what the files or websites did during the test. ⚠️ You can currently only set up...

CVE-2025-29824

🔥 CVE-2025-29824 Zero-Day Exploit 🔥 Welcome to the dark heart of cyberspace, where ethical boundaries bend under the weight of forbidden knowledge. This repository contains a proof-of-concept PoC exploit for CVE-2025-29824 , a use-after-free UAF vulnerability in the Windows Common Log File System...

CIMplant

CIMplant C port of WMImplant which uses either CIM or WMI to query remote systems. It can use provided credentials or the current user's session. Note: Some commands will use PowerShell in combination with WMI, denoted with in the --show-commands command. Introduction CIMplant is a C rewrite and...

CVE-2020-0796-SMBGhost-Exploit-Demo

CVE-2020-0796 Exploit Demo SMBGhost This project demonstrates a proof-of-concept PoC exploit of CVE-2020-0796, also known as SMBGhost - a critical pre-auth RCE vulnerability affecting Windows 10 and Windows Server systems using SMBv3. This was developed as part of a school cybersecurity project...

easyda

EasyDA - Easy Windows Domain Access Script Easy Windows Domain Access Script Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Daniel Compton, daniel dot compton at nccgroup dot com https://github.com/nccgroup/easyda Released under AGPL see LICENSE for more...

Coercer

A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through many methods. Windows Support To build a binary for Windows, download the installer.ps1 script from this repository. Run it simply with no arguments to create a binary in the working directory...

apkleaks

APKLeaks Scanning APK file for URIs, endpoints & secrets. Installation from Pypi from Source from Docker Usage Options Output Pattern Arguments for disassembler License Acknowledments Installation It's fairly simple to install APKLeaks : from PyPi $ pip3 install apkleaks from Source Clone...

CVE-2026-50416-writeup-and-poc

CVE-2026-50416: a kernel address in the desktop heap On the affected system, this read from the user mapping of the Win32 desktop heap returned a kernel address: ULONG64 leaked = ULONG64 desktopheap + 0x100; That is the whole disclosure. At first it was only an eight-byte value with convincing hi...