AtomicSyscall

AtomicSyscall Tools and PoCs for Windows syscall investigation. Table Of Contents AtomicSyscall HeavensGate SyscallDumper SyscallPoCs SyscallResolvers Get-SyscallNumber.ps1 Reference Acknowledgments HeavensGate This directory is for Heaven's Gate technique. See README.md SyscallDumper Back to Top...

BadBlue

BadBlue Windows CVE-2024-21306 BadBlue implementation Using DuckyScript Unauthenticated Peering Leading to Code Execution Using HID Keyboard This is an implementation of the CVE discovered by marcnewlin And some code from BlueDucky Introduction BadBlue is a powerful tool for exploiting a...

honda

RoguePlanet by Nightmare-Eclipse HONDA by nu11secur1ty RoguePlanet Windows Defender Vulnerability Authors: Original Exploit Developer Nightmare-Eclipse Developing, testing, and weaponization nu11secur1ty Penetration Testing Engineer 🧠 Technical Analysis by nu11secur1ty The exploit leverages a rac...

SilentButDeadly

SilentButDeadly Overview SilentButDeadly is a network communication blocker specifically designed to neutralize EDR/AV software by preventing their cloud connectivity using Windows Filtering Platform WFP. This version focuses solely on network isolation without process termination. Blog:...

RemotePotato0

RemotePotato0 UPDATE 21-10-2022: The main exploit scenario RPC- LDAP of RemotePotato0 has been fixed. More details at -- https://twitter.com/splintercode/status/1583555613950255104 Just another "Won't Fix" Windows Privilege Escalation from User to Domain Admin. RemotePotato0 is an exploit that...

SetupHijack

SetupHijack Overview SetupHijack is a security research tool that exploits race conditions and insecure file handling in Windows installer and update processes. It targets scenarios where privileged installers or updaters drop files in %TEMP% or other world-writable locations, allowing an attacke...

CVE-2021-24084

WindowsMDMLPE Demo : https://youtu.be/o5PyVhj3eMw https://blog.0patch.com/2021/11/micropatching-unpatched-local-privilege.html...

CVE-2026-40369-EXPLOIT

Full Blog - https://pwn2nimron.com/blog CVE-2026-40369: Arbitrary Kernel Address Increment via NtQuerySystemInformation Class 253 Summary Type: Arbitrary kernel write increment — PRIVILEGE ESCALATION PRIMITIVE Component: ntoskrnl.exe — ExpGetProcessInformation Trigger:...

CVE-2020-0728

CVE-2020-0728 Details The TrustedInstaller.exe service is running as NTAUTHORITY\SYSTEM and is hosting the Sxs Store Class 3C6859CE-230B-48A4-BE6C-932C0C202048 COM service along with the interface ISxsStore. The access permissions...

CVE_2020_0796_CNA

CVE-2020-0796-CNA Modified based on the PoC provided by danigargu, implemented privilege escalation replication on Windows 10, and developed AggressorScripts based on the Reflective DLL project by stephenfewer and the interface provided by CobaltStrike documentation. This repository is only for...

dubiousdisk

dubious disk - the porygon-z that's super effective against secure boot! CVE-2022-30203, CVE-2023-21560, CVE-2023-28269, CVE-2023-28249, and more... Overly permissive code in the Windows boot environment allows for overwriting arbitrary memory, and therefore, arbitrary code execution. Exploitro...

Zerodoor

ZeroDoor A script written lazily for generating reverse shell backdoors on the go whenever you need without any hassle for your daily penetration needs . These backdoors are not james bond high tech stuff but rather simple ones to prevent over exploitation and limited capabilities Once you genera...

Conveigh

Conveigh Conveigh is a Windows PowerShell LLMNR/NBNS spoofer detection tool. Function Invoke-Conveigh The main Conveigh LLMNR/NBNS spoofer detection function. Privilege Requirements: Elevated Administrator shell Features: Generates and sends IPv4 LLMNR/NBNS requests with random or set hostnames...

SharpDecryptPwd

SharpDecryptPwd A password retrieval tool for common Windows programs: SharpDecryptPwd Usage SharpDecryptPwd.exe Author: Uknow Github: https://github.com/uknowsec/SharpDecryptPwd Reference: https://rcoil.me/2019/09/SharpDecryptPwd/ Usage: SharpDecryptPwd.exe -NavicatCrypto SharpDecryptPwd.exe...

NtDetours

NTSTATUS NTAPI TrInitPVOID ImageBase = &ImageBase; make IAT writable. look for simple.cpp TimedSleepEx calls the real SleepEx API through the TrueSleepEx function pointer. static DWORD WINAPI TrueSleepExDWORD dwMilliseconds, BOOL bAlertable = SleepEx; DWORD WINAPI TimedSleepExDWORD dwMilliseconds...

CVE-2014-4076

CVE-2014-4076 PoC This proof of concept directly copied from its original python version and rewritten in C++. Build This project is built with Visual Studio 2013 Update 4. Notice Only users that in Administrators group can open the device and perform IO controls, which means the exploit only...

CVE-2025-54110-Kernel-EoP-PoC

CVE-2025-54110-Kernel-EoP-PoC PoC implementation for CVE-2025-54110 a Kernel-Level Integer Overflow Vulnerability in the Windows NtQueryDirectoryObject system call. CVE-2025-54110 - Windows Kernel Integer Overflow Analysis CVE: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54110...

Collect-MemoryDump

Collect-MemoryDump Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR Collect-MemoryDump.ps1 is a PowerShell script utilized to collect a Memory Snapshot from a live Windows system including Pagefile Collection in a forensically sound manner. Features: ARM64 Support MAGN...

CVE-2024-43451-POC

Description Name : CVE-2024-43451 CVSSv3 Score : 6.5 Affected Versions : All Microsoft Windows versions before the Nov 2024 Patch CVE-2024-43451 is a zero-day vulnerability in Microsoft Windows that allows attackers to capture NTLMv2 password hashes with minimal interaction from the user,...

cve-2013-3900-remediation-report

Remediation Report: CVE-2013-3900 – WinVerifyTrust Vulnerability on Windows Server 2019 Azure VM Overview During a recent authenticated vulnerability assessment conducted using Tenable Nessus, CVE-2013-3900 was detected on a Windows Server 2019 virtual machine hosted in Microsoft Azure. This scan...