CVE-2020-0796

CVE-2020-0796: SMBGhost - Analysis and Ethical Exploitation Introduction CVE-2020-0796, also known as "SMBGhost," is a critical security vulnerability affecting Microsoft Windows operating systems. It falls under the "wormable" category, meaning it can rapidly propagate across networked systems...

AoratosWin

AoratosWin AoratosWin is a tool that removes traces of executed applications on Windows OS which can easily be listed with tools such as ExecutedProgramList by Nirsoft. Feel free to decompile, reverse, redistribute, etc. Supported OS Tested On Windows 7 x86, x64 Windows 8 x86, x64 Windows 8.1 x86...

CVE-2023-21768-dotnet

CVE-2023-21768 - Dotnet Dotnet / c port of AFD-for-WinSock-EoP exploit References: https://github.com/zoemurmure/CVE-2023-21768-AFD-for-WinSock-EoP-exploit https://github.com/chompie1337/WindowsLPEAFDCVE-2023-21768 Why? Sometimes you can't use compiled binaries. How to? Run the following in...

hassh

"HASSH" - a Profiling Method for SSH Clients and Servers. NOTE: This Corelight repository was created so that it can be actively maintained, as per a request from Salesforce whose original repository is not being maintained. "HASSH" is a network fingerprinting standard which can be used to identi...

CVE-2022-21971

CVE-2022-21971: Uninitialized pointer free in prauthproviders Root-cause The WapAuthProvider::CreateInstance constructor allocates and initializes a WapAuthProvider object 0x78 bytes but it fails to initialize completely its state. The pointer at offset 0x50 is uninitialized and free'd when the...

CVE-2020-0668

CVE-2020-0668 PowerShell implementation, uses printconfig.dll to elevate privileges evil dll can be customized, the dll here will execute the c:\programdata\setup.bat file Reference: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0668...

NOW

NØW — Word-Based Shellcode Encoder Encode shellcode as natural-looking English prose. Decode it back with the right sentence + password. What is NØW? NØW Natural Output Words is a C tool that converts raw shellcode bytes into human-readable English text — either a plain list of codewords or fluen...

Windows-Privilege-Escalation-Notes

Windows Privilege Escalation Preferable room is https://tryhackme.com/room/windows10privesc, but u can use anything of your choice. Some resources, https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/...

LeakedHandlesFinder

LHF - Leaked Handles Finder Leaked Windows processes handles identification tool. Useful for identify new LPE vulnerabilities during a pentest or simply as a new research process. Currently supports exploiting autopwn procesess leaked handles spawning a new arbitrary process cmd.exe default. LHF...

RegPwnBOF

RegPwn BOF Cobalt Strike BOF port of the RegPwn exploit by Filip Dragovic @Wh04m1001 / MDSec ActiveBreach. This is a sloppy BOF reimplementation of the original C exploit. All credit for the vulnerability research and exploit goes to Filip Dragovic and MDSec. Blog post :...

CVE-2022-37969

CVE-2022-37969 Windows Local Privilege Escalation PoC authors: Ricardo Narvaja & Daniel Kazimirow Solid For demonstration purposes only. Complete exploit works on vulnerable Windows 11 21H2 systems. Functional PoC based on previously published information by Zscaler Checkout the writeup...

cromos

Cromos Cromos is a tool for downloading legitimate extensions of the Chrome Web Store and inject codes in the background of the application and more cromos create executable files to force installation via PowerShell for example, and also upload files to dropbox to host the malicious files...

CVE-2015-1578-PoC

CVE-2015-1578-PoC Overview This is a proof-of-concept exploit for CVE-2015-1578 , a buffer overflow vulnerability in Achat 0.150 beta7 on Windows. Exploitation leads to remote code execution via a crafted UDP packet. Purpose This PoC is intended to serve as a clean, minimal, and well-structured...

NimGetSyscallStub

NimGetSyscallStub Get fresh Syscalls from a fresh ntdll.dll copy. This code can be used as an alternative to the already published awesome tools NimlineWhispers and NimlineWhispers2 by @ajpc500 or ParallelNimcalls. The advantage of grabbing Syscalls dynamically is, that the signature of the Stubs...

ManualRsrcDataFetching

ManualRsrcDataFetching: one function to replace FindResource & LoadResource & LockResource & SizeofResource windows apis. Note: Payload.ico is a x64 calc shellcode...

WindowsSpyBlocker

About WindowsSpyBlocker 🛡️ is an application written in Go and delivered as a single executable to block spying and tracking on Windows systems. The approach of this project is to capture and interpret network traffic based on a set of tools. Depending on the interactions between services and...

Windows_AFD_LPE_CVE-2023-21768

CVE-2023-21768 Local Privilege Escalation POC authors: chompie & b33f 复现文章:hlingxbm For demonstration purposes only. Complete exploit works on vulnerable Windows 11 22H2 systems. Write primitive works on all vulnerable systems. Usage: WindowsAFDLPECVE-2023-21768.exe where is the process ID in...

Trawler

Dredging Windows for Persistence What is it? Trawler is a PowerShell script designed to help Incident Responders discover potential indicators of compromise on Windows hosts, primarily focused on persistence mechanisms including Scheduled Tasks, Services, Registry Modifications, Startup Items,...

CVE-2017-7269

CVE 2017.7269 PoC Index CVE 2017.7269 PoC Index Authors Abstract What is Microsoft IIS? What is Microsft Windows server? What is WebDAV? Description Usage: References & Discoverers Authors NoexDevPen - Beacons Profile mag4no10 - Beacons Profile Abstract What is Microsoft IIS? Internet Information...

Cronos-Rootkit

Cronos Rootkit Cronos is Windows 10/11 x64 ring 0 rootkit. Cronos is able to hide processes, protect and elevate them with token manipulation. Features Hide process Elevate process permissions Protect process Contributions Contributions are welcome...