Lucene search
+L

7418 matches found

Kitploit
Kitploit
added 2026/09/14 3:50 a.m.9 views

WSMan-WinRM

WSMan-WinRM A collection of proof-of-concept source code and scripts for executing remote commands over WinRM using the WSMan.Automation COM object. Background For background information, please refer to the following blog post: WS-Management COM: Another Approach for WinRM Lateral Movement Notes...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/14 3:46 a.m.6 views

RightHand-Persistence

RightHand Persistence inspired by CVE-2026-21509 C++ COM Context Menu Handler for Persistence A sample implementation of a Windows context menu handler using C++ and COM, demonstrating a stealthy persistence technique. By registering a custom COM object, your code executes whenever a user...

7.8CVSS7.8AI score0.72554EPSS
SaveExploits15
Kitploit
Kitploit
added 2026/09/14 3:15 a.m.7 views

COM-Hunter

COM-Hunter COM Hijacking VOODOO Description COM-Hunter is a COM Hijacking persistence tool. Available in both a .NET version and a BOF variant fully compatible with Cobalt Strike. The following list explains the available modes: Search Mode : Searches for CLSIDs based on LocalServer32,...

5.9AI score
SaveExploits0References5
Kitploit
Kitploit
added 2026/09/14 2:39 a.m.12 views

DSCourier_BOF

DSCourier BOF This is a BOF implementation of Dylan Davis and Matthew Schramm's DSCourier project. It uses WinGet's COM interface to execute arbitrary powershell code in a Microsoft signed and trusted process. Their full research blog can be found here. Unlike most projects I release, this is NOT...

5.9AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/14 1:48 a.m.6 views

CVE-2023-36874_BOF

CVE-2023-36874 Windows Error Reporting LPE BOF Introduction This is a mature and operational CobaltStrike BOF implementation of Filip Dragovic's @filipdragovic CVE-2023-36874 Windows Error Reporting LPE exploit. He did the heavy lifting in terms of creating a working exploit by reversing the...

7.8CVSS7.6AI score0.43409EPSS
SaveExploits6References2
Kitploit
Kitploit
added 2026/09/14 12:27 a.m.8 views

OffensiveCSharp

OffensiveCSharp This is a collection of C tooling and POCs I've created for use on operations. Each project is designed to use no external libraries. Open each project's .SLN in Visual Studio and compile as "Release". Project| Description| Minimum .NET Version ---|---|--- AbandonedCOMKeys|...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/14 12:06 a.m.8 views

CVE-2019-9730

CVE-2019-9730: Synaptics Audio Driver LPE The vulnerability in this driver package was with the CxUtilSvc system service. It hosted a COM object that low-privileged code can use to perform arbitrary reads and writes to the registry as SYSTEM. The .NET code adds the IRegistryHelper COM interface a...

8.8CVSS7.9AI score0.00998EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/13 11:55 p.m.11 views

WFH

Windows Feature Hunter WFH Windows Feature Hunter WFH is a proof of concept python script that uses Frida, a dynamic instrumentation toolkit, to assist in potentially identifying common “vulnerabilities” or “features” within Windows executables. WFH currently has the capability to automatically...

5.9AI score
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/13 10:34 p.m.12 views

SessionHop

SessionHop SessionHop is a C tool that utilizes the IHxHelpPaneServer COM object, configured to run as an Interactive User, to hijack specified user sessions. By creating a session moniker and utilizing the COM object's Execute interface, operators can run arbitrary files within another user's...

6AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/13 9:37 p.m.7 views

DSCourier

DSCourier Description DSCourier is a proof-of-concept that uses the WinGet Configuration COM API to apply DSC configurations through Microsoft-signed binaries. A separate blog post provides the full technical deep dive into the technique. DSCourier was built primarily from a research topic and...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 9:15 p.m.10 views

COM-Code-Helper

COM-Code-Helper Two IDAPython Scripts help you to reconstruct Microsoft COM Component Object Model Code Especially malware reversers will find this useful, as COM Code is still regularly found in malware. ClassAndInterfaceToNames.py This IDAPython script scans an idb file for class and interfaces...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 8:52 p.m.9 views

ZipExec

ZipExec ZipExec is a Proof-of-Concept POC tool to wrap binary-based tools into a password-protected zip file. This zip file is then base64 encoded into a string that is rebuilt on disk. This encoded string is then loaded into a JScript file that when executed, would rebuild the password-protected...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 8:34 p.m.48 views

msidump

msidump MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner. On Macro-enabled Office documents we can quickly use oletools mraptor to determine whether document is malicious. If we want to dissect it further, we...

5.5AI score
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/13 8:32 p.m.7 views

CVE-2020-0728

CVE-2020-0728 Details The TrustedInstaller.exe service is running as NTAUTHORITY\SYSTEM and is hosting the Sxs Store Class 3C6859CE-230B-48A4-BE6C-932C0C202048 COM service along with the interface ISxsStore. The access permissions...

5.5CVSS6.6AI score0.03732EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/13 7:44 p.m.8 views

BadOutlook

Bad Outlook A simple PoC which leverages the Outlook Application Interface COM Interface to execute shellcode on a system based on a specific trigger subject line. By utilizing the Microsoft.Office.Interop.Outlook namespace, developers can represent the entire Outlook Application or at least...

6.4AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 7:17 p.m.8 views

CVE-2020-1313

CVE-2020-1313 Abstract Windows Update Orchestrator Service is a DCOM service used by other components to install windows updates that are already downloaded. USO was vulnerable to Elevation of Privileges any user to local system due to an improper authorization of the callers. The vulnerability...

7.8CVSS7.3AI score0.38974EPSS
SaveExploits5References1
Kitploit
Kitploit
added 2026/09/13 4:42 p.m.8 views

IDiagnosticProfileUAC

IDiagnosticProfileUAC Just another UAC bypass using auto-elevated COM object Virtual Factory for DiagCpl 12C21EA7-2EB8-4B55-9249-AC243DA8C666. This COM object can be used to create instance of DiagnosticProfile D0B7E02C-E1A3-11DC-81FF-001185AE5E76 COM object which exposes SaveDirectoryAsCab metho...

6AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/13 4:33 p.m.5 views

ZeroCrumb

ZeroCrumb Dumping App Bound Protected Credentials & Cookies Without Privileges. Explanation ZeroCrumb bypasses the Chrome Elevation Service by impersonating a Chrome instance using Transacted Hollowing, Effectively allowing us to use the IElevator COM interface to decrypt the App Bound Key. Then,...

5.8AI score
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/13 4:25 p.m.8 views

CLSIDFinder

CLSIDFinder Invoke-CLSIDFinder enumerates CLSID and AppID entries from the Windows registry to identify COM objects associated with Windows services via the LocalService value. The function correlates these entries, exports the results to a CSV file, and attempts COM activation when the related...

6AI score
SaveExploits0References1
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.57 views

Joomla! Component Property - Local File Inclusion

A directory traversal vulnerability in the Real Estate Property comproperties component 3.1.22-03 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1875 info: name: Joomla...

7.5CVSS6.1AI score0.15722EPSS
SaveExploits2References5
Rows per page
Query Builder