py-amsi

py-amsi py-amsi 是一个使用 Windows 反恶意软件扫描接口 AMSI API 扫描字符串或文件以查找恶意软件的库。AMSI 是 Windows 原生接口，允许应用程序请求系统上安装的防病毒软件分析文件/字符串。AMSI 不依赖于 Windows Defender。防病毒供应商实现 AMSI 接口以接收来自应用程序的调用。此库利用该 API 在 Python 中执行防病毒扫描。了解更多关于 Windows AMSI API 的信息，请点击此处。 安装 通过 pip root@kitploit: pip install pyamsi 克隆仓库 root@kitploit:...

batondrop_armv7

baton drop for armv7 MSM8960 Given that policyhax aka golden key's fix actually works on Qualcomm systems, I picked up a working but sold for-parts Dell XPS 10 to port baton drop to MSM8960. Here is the result. Extract image.7z to your GPT fat32-formatted USB device, copy your unsigned EFI boot...

Microsoft-CVE-2021-1675

Microsoft-CVE-2021-1675 I have created a small C project that exploits vulnerability CVE-2021-1675. For more information about CVE-2021-1675, please check my blog post: https://thalpius.com/2021/07/16/windows-print-spooler-elevation-of-privilege-vulnerability-cve-2021-1675-explained Usage Microso...

POC-CVE-2020-0796

- Affected versions - Windows 10 Version 1903 for 32-bit Systems - Windows 10 Version 1903 for ARM64-based Systems - Windows 10 Version 1903 for x64-based Systems - Windows 10 Version 1909 for 32-bit Systems - Windows 10 Version 1909 for ARM64-based Systems - Windows 10 Version 1909 for...

CVE-2024-4577

CVE-2024-4577 Overview CVE-2024-4577 is a security vulnerability that affects PHP servers in the following versions: PHP 8.3.x 8.3.8 and earlier PHP 8.2.x 8.2.20 and earlier PHP 8.1.x 8.1.29 and earlier All versions prior to 8.0 Unsupported versions 7.x and 5.x This vulnerability is a remote code...

CVE-2020-0796

CVE-2020-0796: SMBGhost - Analysis and Ethical Exploitation Introduction CVE-2020-0796, also known as "SMBGhost," is a critical security vulnerability affecting Microsoft Windows operating systems. It falls under the "wormable" category, meaning it can rapidly propagate across networked systems...

CVE-2024-20698

CVE-2024-20698 Acerca de esta vulnerabilidad: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20698 Análisis del parche En ntoskrnl.exe tenemos dos funciones parcheadas: sub1406AE224 y WbAddLookupEntryEx. La función vulnerable es WbAddLookupEntryEx. Rutas a esta función: Para llama...

Geutebrueck_GCore_X64_RCE_BO

GeutebrueckGCoreX64RCEBO Módulo de Metasploit para el sistema de "gestión de video" Geutebrueck GCore. Probado con las versiones 1.3.8.42 y 1.4.2.37. Ejecución remota de código completa con privilegios de NT/System en Windows Win 2012R2, Win8.1, ... con los productos Geutebrueck instalados GCore...

CVE-2024-2432-PaloAlto-GlobalProtect-EoP

CVE-2024-2432 Palo Alto GlobalProtect EoP En sistemas Windows, se descubrió que GlobalProtect versiones de aplicación 6.1.1-5 y 6.2.0-89 era vulnerable a la eliminación arbitraria de archivos con privilegios elevados mediante un ataque de enlace simbólico, lo que conduce a una escalada de...

CVE-2019-0708-poc

CVE-2019-0708 Big shout out to the Dox King Krebs and also the thief of inventions and all-purpose fraud, Kevin. https://www.youtube.com/watch?v=dQw4w9WgXcQ...

win-exec-calc-shellcode

win-exec-calc-shellcode Shellcode pequeño y libre de NUL que ejecuta calc.exe. Se ejecuta en versiones x86 y x64 de Windows 5.0-6.3 2000, XP, 2003, 2008, 7, 8, 8.1, todos los service packs. Tamaños build 306...

CVE-2020-0796

CVE-2020-0796 Overview: The compression feature added to SMBv3 starting from Windows 10/Server version 1903 contains an integer overflow vulnerability confirmed by Microsoft on 12/03/2020. It allows an attacker to perform Local Privilege Escalation LPE and Remote Code Execution RCE. Here we will...

CVE-2026-54107

Cuando ValidateHwnd no es una puerta: análisis de la causa raíz de CVE-2026-54107 Un use-after-free en la gestión del ciclo de vida de ventanas de win32kfull.sys — cómo lo encontré, cómo me convencí de que era real, y cómo se ve realmente el proceso de MSRC desde el lado del investigador. Eran ca...

NotSecDrv

NotSecDrv - A PoC code for CVE-2018-7249 General Description An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 before KB3086255, and as shipped in Macrovision SafeDisc. Two carefully timed calls to IOCTL 0xCA002813 can cause a race...

CVE-2021-1675_PrintNightMare

PrintNightmareScanner Scanner to detect Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-1675 Prerequisite's python3 python3 -m pip install -r Requirements.txt Usage python3 detectprintnightmare.py --help root@kitploit: usage: detectprintnightmare.py -h -t TARGET -T TARGETS -c...

CVE-2020-0753-and-CVE-2020-0754

Writeup and POC for CVE-2020-0753, CVE-2020-0754 and six fixed Window DOS Vulnerabilities Exploit FileSystem race condition bug - analysis of CVE-2020-0753 and CVE-2020-0754 Windows Error Reporting service has fixed 2 Elevation of Privilege bugs in last Patch Tuesday, the two bugs are assigned wi...

dll-injector

About As the name suggests, the application primarily performs injecting a DLL into any process running on Windows. With the power of this, it is able to perform several operations on a process such as loading a DLL, unloading a DLL, and hooking primary WinAPI functions e.g., CreateFileW, ReadFil...

Why-so-Serious-SAM

PoC del exploit 'Fileless' de HiveNightmare: Tabla de contenidos Overview Features Lab Simulation Example Reconnaissance with Google Dorks LOLBins Overview Fileless Dropper Embedding Exploiting Print Spooler & HiveNightmare Reflective DLL Injection MITRE ATT&CK Mapping Detection & Mitigation Lega...

SMBRat

SMBRat Una Herramienta de Administración Remota para Windows en Visual Basic Script Idea Los Entornos Windows como las redes de Active Directory , se saturan bastante con el tráfico SMB. Todos los hosts reciben Políticas del SYSVOL , las configuraciones necesitan archivos remotos para funcionar,...

CVE-2024-38063

CVE-2024-38063 - Explotando el kernel de forma remota mediante IPv6 Desde que cayó el último parche de Windows el 13 de agosto, he estado metido de lleno en tcpip.sys el controlador del kernel responsable de manejar los paquetes TCP/IP. Una vulnerabilidad con una puntuación CVSS de 9.8 en la part...