CVE-2017-0213

CVE-2017-0213: Windows COM Elevation of Privilege Vulnerability Description Author: Google Security Research CVE: 2017-0213 EDB-ID: 42020 References: Project-Zero Microsoft Exploit-Database Video: Youtube Affected Products Product| Version| Update| Build| Tested ---|---|---|---|--- Windows 10|...

CVE-2015-6132

CVE-2015-6132 Microsoft Office / COM Object DLL Planting Original poc: https://www.exploit-db.com/exploits/38968/ Running poc.rtf with mqrt.dll in the same directory will trigger the dll, which in this case pop calc making Down/exec Dll will work as well Exporting the dll to run from Samba/WebDav...

acCOMplice

acCOMplice Your COM hijacking accomplice Author: David Tulis @kafkaesqu3 Overview This repository contains code samples and proofs-of-concept for exploring COM hijacking. COM hijacking is a Windows post exploitation technique, which can be used for persistence or defense evasion. For more...

JuicyPotatoNG

JuicyPotatoNG Just another Windows Local Privilege Escalation from Service Account to System. Full details at -- https://decoder.cloud/2022/09/21/giving-juicypotato-a-second-chance-juicypotatong/ Usage JuicyPotatoNG by decoderit & splintercode Mandatory args: -t createprocess call:...

OffensiveCSharp

OffensiveCSharp This is a collection of C tooling and POCs I've created for use on operations. Each project is designed to use no external libraries. Open each project's .SLN in Visual Studio and compile as "Release". Project| Description| Minimum .NET Version ---|---|--- AbandonedCOMKeys|...

ZipExec

ZipExec ZipExec is a Proof-of-Concept POC tool to wrap binary-based tools into a password-protected zip file. This zip file is then base64 encoded into a string that is rebuilt on disk. This encoded string is then loaded into a JScript file that when executed, would rebuild the password-protected...

DSCourier

DSCourier Description DSCourier is a proof-of-concept that uses the WinGet Configuration COM API to apply DSC configurations through Microsoft-signed binaries. A separate blog post provides the full technical deep dive into the technique. DSCourier was built primarily from a research topic and...

msidump

msidump MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner. On Macro-enabled Office documents we can quickly use oletools mraptor to determine whether document is malicious. If we want to dissect it further, we...

COM-Hunter

COM-Hunter COM Hijacking VOODOO Description COM-Hunter is a COM Hijacking persistence tool. Available in both a .NET version and a BOF variant fully compatible with Cobalt Strike. The following list explains the available modes: Search Mode : Searches for CLSIDs based on LocalServer32,...

CVE202015808

CVE-2020-15808 A proof of concept of CVE-2020-15808 vulnerability exploit on STM32F4 Discovery board Requirements Firmware version older than 1.25.2 Board with VCP ex. STM32F4 discovery arm-none-eabi toolchain Steps to reproduce the exploit 1. Move to VulnerableFirmwareF4 and compile through make...

OWN-Defender

OWN-Defender — Windows Security Center COM Research OWN-Defender is a Windows security research project focused on understanding how Windows Security Center WSC represents and manages antivirus security products through its COM interfaces. The project began as an investigation into the behavior...

SessionHop

SessionHop SessionHop is a C tool that utilizes the IHxHelpPaneServer COM object, configured to run as an Interactive User, to hijack specified user sessions. By creating a session moniker and utilizing the COM object's Execute interface, operators can run arbitrary files within another user's...

CVE-2026-66804-CrossDevice-Service-EoP

CVE-2026-66804: Cross Device Virtual Camera EoP I independently discovered and reported the issue now tracked as CVE-2026-66804. MSRC confirmed my submission as a duplicate of an earlier report with the same underlying Windows Camera FrameServer root cause. A standard Windows user can create a...

presentations

My presentations More things can be found in my personal site: https://sites.google.com/site/zhiniangpeng Exploiting preauth RCE and Sandbox escape vulnerabilities in EXSi, Typhooncon 2023 OLE object are still dangerous today — Exploiting Microsoft Office, POC 2023 Django-Simple-Captcha —...

CVE-2023-36874

CVE-2023-36874 Proof of Concept PoC An educational and defensive research implementation of the CVE-2023-36874 vulnerability, demonstrating a Local Privilege Escalation LPE flaw within the Windows Error Reporting WER component. ⚠️ Disclaimer This repository and the provided source code are intende...

TrustedHive

TrustedHive - CVE-2026-81963 Suspected Local privilege escalation via ungated CBS COM method - medium-IL to SYSTEM arbitrary file write on Windows 11 Table of Contents Disclosure Timeline The Vulnerability Affected versions How my approach works MSRC Response Suspected CVE Usage & Repository...

DataInject-BOF

Data Inject BOF A beacon object file implementation of the process injection proof-of-concept from my blog post Control Flow Hijacking via Data Pointers. Hijacks control flow via overwriting combase.dll's Control Flow Guard function pointers called by COM proxying functions. Important Notes From ...

Estudo-de-Caso-CVE-2024-21413

CVE-2024-21413 — Moniker Link 🔗💀 Microsoft Outlook RCE + NTLM Credential Leak ⚠️ Legal Notice: This repository is exclusively for educational and security research purposes. All demonstrations were carried out in controlled and isolated environments. The use of these techniques against systems...

CVE-2024-21378

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ 🛡️ CVE-2024-21378...

CVE-2019-9730

CVE-2019-9730: Synaptics Audio Driver LPE The vulnerability in this driver package was with the CxUtilSvc system service. It hosted a COM object that low-privileged code can use to perform arbitrary reads and writes to the registry as SYSTEM. The .NET code adds the IRegistryHelper COM interface a...