adiskreader-secretsdump

🚩 Sponsors If you like this project, consider purchasing licenses of OctoPwn, our full pentesting suite that runs in your browser! For notifications on new builds/releases and other info, hop on to our Discord adiskreader-secretsdump Extract registry and NTDS secrets from local or remote disk...

CVE-2025-21420-PoC

CVE-2025-21420 PoC Windows Disk Cleanup Tool Elevation of Privilege Vulnerability AFAIK, albeit incomplete, this is the first PoC to this CVE. https://nvd.nist.gov/vuln/detail/CVE-2025-21420 https://vulners.com/cve/CVE-2025-21420 We found a way to DLL sideload with cleanmgr.exe $ cp .\dokan1.dll...

Volumiser

Volumiser Introduction Volumiser is a command line tool and interactive console GUI for listing, browsing and extracting files from common virtual machine hard disk image formats. The tool was written to combat a regular problem where massive 100G+ disk images are often hard to work with or...

dubiousdisk

dubious disk - the porygon-z that's super effective against secure boot! CVE-2022-30203, CVE-2023-21560, CVE-2023-28269, CVE-2023-28249, and more... Overly permissive code in the Windows boot environment allows for overwriting arbitrary memory, and therefore, arbitrary code execution. Exploitro...

uac

Unix-like Artifacts Collector UAC About • Documentation • Main Features • Supported Operating Systems • Usage • Contributing • Support • License 🔎 About UAC UAC Unix-like Artifacts Collector is a powerful and extensible incident response tool designed for forensic investigators, security analysts...

jit

JitPass You have API keys and tokens in plaintext on your Mac. Use JitPass to protect them. Download for Mac · brew install jitpass/tap/jitpass · Docs · jitpass.com Free for personal and internal company use · Source-available · No account · No telemetry · Nothing leaves your Mac · Secure Enclave...

CVE-2025-48799

Description This is PoC for CVE-2025-48799, an elevation of privilege vulnerability in Windows Update service. This vulnability affects windows clients win11/win10 with at least 2 hard drives. When machine have multiple hard drives it is possible to change location where new content is saved usin...

incus-os

Introduction IncusOS is an immutable OS image dedicated to running Incus. It's based on Debian 13 and built using mkosi. IncusOS can be installed on modern amd64 x8664 and arm64 systems. This aims at providing a very fast, safe and reliable way to run an Incus server. It's got a strong focus on...

MaliciousMacroGenerator

Malicious Macro Generator Utility Simple utility design to generate obfuscated macro that also include a AV / Sandboxes escape mechanism. Requirement Python 2.7 Usage MMG.Malicious Macro Generator v2.0 - RingZer0 Team Author: Mr.Un1k0d3r [email protected] Usage: MMG.py config output optional...

ExtractUsnJrnl

The change journal on NTFS is a file found at $Extend$UsnJrnl. It is a system metafile that is not possible to find in a normal dir listing, or even posible to by regular means. The relevant data is found in the alternate data stream named $J. There's also another ADS called $Max which is rather...

libvhdi

libvhdi is a library to access the Virtual Hard Disk VHD image format. Project information: Status: alpha Licence: LGPL-3.0-or-later Read supported formats: Virtual Hard Disk version 1 VHD Virtual Hard Disk version 2 VHDX Supported image types: Fixed-size hard disk image Dynamic-size or sparse ha...

libvmdk

libvmdk is a library to access the VMware Virtual Disk VMDK format. Project information: Status: alpha Licence: LGPL-3.0-or-later Read supported extent file formats: RAW flat COWD version 1 sparse VMDK version 1, 2 and 3 sparse Supported VMDK format features: delta links grain compression as of...

sleuthkit

The Sleuth Kit INTRODUCTION The Sleuth Kit is an open source forensic toolkit for analyzing Microsoft and UNIX file systems and disks. The Sleuth Kit enables investigators to identify and recover evidence from images acquired during incident response or from live systems. The Sleuth Kit is open...

CVE-2019-9702_Symantec_Encryption_Desktop_LPE_PoC

Symantec Encryption Desktop PGPwded.sys local privilege escalation PoC This repository contains a proof-of-concept for a local privilege escalation path in Symantec Encryption Desktop's PGPwded.sys storage filter, based on a low-privileged raw disk read/write primitive. The PoC was developed and...

CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV

Executive summary macOS Music and TV do an insecure rename resulting in FDA by gaining full control over the user's TCC.db I reported this bug in separate tickets for each app, feel free to merge if applicable. The underlying problem is that these apps have FDA but fail to sanitize their file...

hashr

HashR: Generate your own set of hashes Table of Contents HashR: Generate your own set of hashes Table of Contents About Requirements Building HashR binary and running tests Setting up HashR HashR using docker OS configuration & required 3rd party tooling Setting up storage for processing tasks...

LAB-DFIR-cve-2023-38831

LAB-DFIR-cve-2023-38831 This lab simulates a CVE-2023–38831 attack and must investigate diskimage and contains a variety of questions including understanding the Windows registry, NTFS files, cache browser, and a complete understanding of the functions that come out of Windows in the sequence of...

initroot

Exploiting CVE-2016-10277 More information at: https://alephsecurity.com/2017/06/07/initroot-moto/ If you just want to check if your device is vulnerable, it might be quicker if you just flash stock ramdisk without any modifications. If it's your case, just look for initroot--STOCK.cpio.gz...

mailorder

Mail Order The Nalpeiron Licensing Service NLSSRV32.exe is installed as part of certain software installations to handle privileged software licensing operations. It is paired with a client component filechck.dll which communicates with the service via mailslots hence the name. Calls are performe...

stenographer

Stenographer Overview Stenographer is a full-packet-capture utility for buffering packets to disk for intrusion detection and incident response purposes. It provides a high-performance implementation of NIC-to-disk packet writing, handles deleting those files as disk fills up, and provides method...