CVE-2020-0601

CVE-2020-0601 PoC for CVE-2020-0601- Windows CryptoAPI Crypt32.dll POC: https://github.com/ollypwn/CurveBall On kali: 1.Make PKCS12 file openssl req -new -x509 -key spoofedca.key -out spoofedca.crt openssl ecparam -name secp384r1 -genkey -noout -out Microsoft.key openssl req -new -key Microsoft.k...

fulcio

Fulcio A Free-to-Use CA For Code Signing Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity, such as email address. Fulcio only issues short-lived certificates that are valid for 10 minutes. Public Instance Fulcio is in General...

frida

Frida Kit de instrumentación dinámica para desarrolladores, ingenieros inversos e investigadores de seguridad. Más información en frida.re. Dos formas de instalar 1. Instalar desde binarios precompilados Esta es la forma recomendada para comenzar. Todo lo que necesitas hacer es: pip install...

Curveball

Curveball A PoC for CVE-2020-0601. A detailed blog post can be found here. This exploit allows you to create a fake trusted certificate by abusing how CryptoAPI handles certain parameters on ECC based certificates. Setup Clone the repository and open it in Visual Studio 2019. Switch to Release an...

CarbonCopy

CarbonCopy A tool which creates a spoofed certificate of any online website and signs an Executable for AV Evasion. Works for both Windows and Linux Prerequisites In order to use it on Linux, please execute commands below: apt-get install osslsigncode pip3 install pyopenssl...

CurveballCertTool

CurveballCertTool CVE-2020-0601 This automated bash script for Code Signing was created using this repository: https://github.com/ollypwn/CurveBall Please use this script for educational purposes only. Requirements openssl ruby osslsigncode Usage ./CurveballCertTool.sh -c: Create new "legit"...

Loki

🧙‍♂️ Loki Command & Control Loki is a stage-1 command and control C2 framework written in Node.js, built to script-jack vulnerable Electron apps MITRE ATT&CK T1218.015. Developed for red team operations, Loki enables evasion of security software and bypasses application controls by exploiting...

apk.sh

🕹️ apk.sh apk.sh is a Bash script that makes reverse engineering Android apps easier, automating some repetitive tasks like pulling, decoding, rebuilding and patching an APK. Features apk.sh basically uses apktool to disassemble, decode and rebuild resources and some bash to automate the frida...

LazySign

LazySign Crea certificados falsos para binarios usando binarios de Windows y el poder de archivos bat A lo largo de los años, se han lanzado varias herramientas geniales que son capaces de robar o falsificar firmas para archivos binarios. Sin embargo, todas estas herramientas tienen dependencias...

Limelighter

LimeLighter Una herramienta que crea certificados de firma de código falsos y firma binarios y archivos DLL para ayudar a evadir productos EDR y evitar el escrutinio de MSS y SOC. LimeLighter también puede usar certificados de firma de código válidos para firmar archivos. LimeLighter puede usar u...

CVE-2020-0601

CVE-2020-0601 : CurveBall CVE exploitation This ruby script can be used to spoof a legit certificate authority and generat a certificate that will be considered valid for Windows computer affected by the CurveBall vulnerability. You need to get a certificate comming from the certificate authority...

CertVerify

CertVerify CertVerify es una herramienta diseñada para detectar archivos ejecutables exe, dll, sys que han sido firmados con certificados de firma de código no confiables o filtrados. El propósito de esta herramienta es identificar archivos potencialmente maliciosos que se han firmado utilizando...

Clickstudio-compromised-certificate

Compromised clickstudio certificate Extracted from : f3ccf22db2c1060251096fe99464002318baccf598b626f8dbdd5e7fd71fd23f Serial : 0394517DACDC71187A40001B5CC32DE5 Signer Hash : 79bae9ba9b80cd349ebe9a4165224e816f3b597c Certificate information Current PE checksum : 00014A49 Calculated PE checksum:...

CVE-2020-0601-spoofkey

CVE-2020-0601-spoofkey To see how to Make Spoofed Key and Signing the code REQ: openssl, main.rbwhich i uplaoded VISIT : https://twitter.com/exploitblizzard...

Fugu15

Fugu15 Fugu15 is a semi-untethered permasigned jailbreak for iOS 15. It contains a code-signing bypass, kernel exploit, kernel PAC bypass and PPL bypass. Additionally, it can be installed via Safari, i.e. a computer is not required, except for a Web Server that hosts Fugu15. Please note that Fugu...

MagicSigner

MagicSigner Patcher dll for signtool that allows signing with expired certificates Usage Just place XmlLite.dll next to signtool.exe Demo Before MagicSigner After MagicSigner Alternative solutions You can also just set the clock on your computer back. However that needs admin privileges, and has...

certReport

CertReport This tool is intended to reduce the load of effort required to report authenticode certificates. It is intended to take the smallest amount of effort from the reporter, but provide the certificate authority with most the information they need to make a decision. When possible, it is...

CurveBall-CVE-2020-0601-PoC

CurveBall CVE-2020-0601 - PoC This vulnerability, known as CurveBall, is due to invalid verification of certificates that using the ECC algorithm. Windows try to verify previously verified certificates from the certificate cache and while doing this, it only checks whether the public keys of the...

CVE-2025-51726

As requested, I have now demonstrated both vulnerabilities BA2022 & BA2015 with practical exploitation scenarios and PoC evidence, which shows how an attacker could abuse these issues in a real-world context. 📌 1. BA2022 Weak Hash in Code Signing – SHA-1 Exploitation Demonstration Although the...

CVE-2026-86819

Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement...