patching

Patching - Interactive Binary Patching for IDA Pro Overview Patching assembly code to change the behavior of an existing program is not uncommon in malware analysis, software reverse engineering, and broader domains of security research. This project extends the popular IDA Pro disassembler to...

CVE-2020-16938

CVE-2020-16938 CVE-2020-16938 is a vulnerability that allows you to get unrestricted file read capabilities on the entire disk as unprivileged user. The bug was originally found and reported by my friend Jonas. His PoC can be found here. My version of the exploit consists of a bunch of Windows AP...

concealed_position

Concealed Position Concealed Position is a local privilege escalation attack against Windows using the concept of "Bring Your Own Vulnerability". Specifically, Concealed Position CP uses the as designed package point and print logic in Windows that allows a low privilege user to stage and install...

ShadowSteal

ShadowSteal | CVE-2021-36934 Pure Nim implementation for exploiting CVE-2021-36934, the SeriousSAM Local Privilege Escalation LPE. Not OPSEC safe.... yet ;. I do not claim credit for the discovery of this exploit. Quick Start Build with Docker Getting started with ShadowSteal is now easier than...

Wifi-Dumper

Wifi-Dumper This is an open source tool to dump the wifi profiles and cleartext passwords of the connected access points on the Windows machine. This tool will help you in a Wifi testing. Furthermore, it is useful while performing red team or an internal infrastructure engagements. Features Optio...

CVE-2025-8088

Technical Deep Dive: CVE-2025-8088 - The Resilient Path Traversal Disclaimer: This content is for educational and research purposes only. Do not use this information for any malicious activities. Today, we're taking a deep dive into a fascinating path traversal vulnerability, tracked as...

Remote-DLL-Injection-with-Timer-based-Shellcode-Execution

Remote DLL Injection with Timer-based Shellcode Execution Documentation updated from previous mistake proces injection title! ⚠ Educational Research Only This repository contains security research for educational purposes and authorized use only. Use responsibly and in accordance with all...

TelemetrySource

TelemetrySource Project created to map functions repsonsible for triggering events from various telemetry sources. Main Mapping Sheet: Event Mapping Google Sheet Currently mapped sources: Sysmon Window Security Events Microsoft-Windows-Security-Auditing Threat Intelligence Events...

smbghost

SMBGhost aka CoronaBlue Artefacts PCAPs win7crashfalse.pcap Win7, no crash win10crashtrue.pcap Win10, triggers BSOD win7notvulnerable.pcap Win7 scanning, results as non-exploitable win10vulnerable.pcap Win10 scanning, results as exploitable...

WTSRM

WTSRM - Writing Tiny Small Reliable Malware demo repository for my corresponding talk. Unhooks all Windows Dlls with \KnownDlls\ No CRT dependencies Small size Low entropy Random string encryption key thus no plaintext strings API hashing Hook detection Walks around hooks for initial unhooking on...

cve-2018-8120

cve-2018-8120 Details see: http://bigric3.blogspot.com/2018/05/cve-2018-8120-analysis-and-exploit.html...

DNS_Tunneling

Intro Inspired by recent work I did involving Cobalt Strike DNS beacons, in conjunction with a mission statement to try and evade Microsoft Defender for Endpoint, I spent some time looking into how DNS might be used to transfer a payload to a target machine. I further wanted to challenge myself b...

Wynis

Wynis Just a powershell scripts for auditing security with BEST Practices Windows env You just need to run the script, it will create a directory named : AUDITCONF%MACHINENAME%DATE% Actualy, the script are : -WynisWIN2016DC-CISv1.0 : Auditing DC 2016 with CIS -Wynis-AD : Auditing Domain Security...

TrustJack

TrustJack Yet another PoC for https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows Blogpost: https://redteamer.tips/?p=108 To be used with a cmd that does whatever the F you want, for a dll that pops cmd, https://github.com/jfmaes/CMDLL. check the list in wietze's site to check how you...

CVE-2026-2636_PoC

CVE-2026-2636: CLFS.sys Unrecoverable State Leading to BSoD Overview CVE-2026-2636 is a vulnerability in the Windows Common Log File System CLFS driver CLFS.sys. An unprivileged user can trigger an unrecoverable system state by calling the ReadFile API on a handle opened via CreateLogFile. This...

SharpDecryptPwd

SharpDecryptPwd This project is no longer updated, the refactored source code project is as follows https://github.com/RowTeam/SharpDecryptPwd Introduction Parses passwords saved on Windows systems for some programs, including: Navicat, TeamViewer, FileZilla, WinSCP, Xmangager series products...

Adalanche

Adalanche Open Source Attack Graph Visualizer and Explorer Adalanche gives instant results, showing you what permissions users and groups have in an Active Directory. It is useful for visualizing and exploring who can take over accounts, machines or the entire domain, and can be used to find and...

honda

RoguePlanet by Nightmare-Eclipse HONDA by nu11secur1ty RoguePlanet Windows Defender Vulnerability Authors: Original Exploit Developer Nightmare-Eclipse Developing, testing, and weaponization nu11secur1ty Penetration Testing Engineer 🧠 Technical Analysis by nu11secur1ty The exploit leverages a rac...

bt2

bt2: Blaze Telegram Backdoor Toolkit bt2 is a Python-based backdoor in form of a IM bot that uses the infrastructure and the feature-rich bot API provided by Telegram, slightly repurposing its communication platform to act as a C&C. Dependencies Telepot requests Installation $ sudo pip install...

sn0int

sn0int sn0int pronounced /snoɪnt/ is a semi-automatic OSINT framework and package manager. It's used by IT security professionals, bug bounty hunters, law enforcement agencies and in security awareness trainings to gather intelligence about a given target or about yourself. sn0int is enumerating...