CVE-2020-3153

CVE-2020-3153 Cisco AnyConnect 4.8.02042 privilege escalation through path traversal Description The auto-update feature of Cisco AnyConnect is affected by a path traversal vulnerability. An attacker can exploit this vulnerability to gain system level privileges. For more details, please refer to...

Robber

Robber — DLL Hijack Scanner Free, open source tool for finding DLL hijacking opportunities in Windows executables. No third-party dependencies. What it does Windows loads DLLs by searching a fixed set of directories in order — the executable's own directory first, then System32, Windows, PATH...

RansomLord

RansomLord NG v1.0 Anti-Ransomware exploit tool. Proof-of-concept tool that automates the creation of PE files, used to exploit ransomware pre-encryption. Updated version NG: https://github.com/malvuln/RansomLord/releases/tag/v1.0 Lang: C SHA256:...

CVE-2024-39069

ifood Order Manager 'Gestor de Peddios.exe' - DLL hijacking An attacker places a malicious DLL named "d3d12.dll" in a directory that is searched by the application before the legitimate "d3d12.dll" is found. When the application is launched, it loads the malicious DLL instead of the legitimate on...

SCCM-CVE-2026-47301-Remote-Code-Execution-Exploit

SCCM-CVE-2026-47301-Remote-Code-Execution-Exploit Proof-of-concept exploit chain I have discovered assigned as CVE-2026-47301 for Microsoft Configuration Manager SCCM, combining broken access control, CAB extraction-path traversal arbitrary file write, certificate verification bypass, and DLL...

CVE-2024-6473-PoC

CVE-2024-6473 PoC Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used. Vulnerable browser version !IMPORTANT The Internet must be turned off during installation, otherwise the browser will be updated. You can download vulerable...

OffensiveCSharp

OffensiveCSharp This is a collection of C tooling and POCs I've created for use on operations. Each project is designed to use no external libraries. Open each project's .SLN in Visual Studio and compile as "Release". Project| Description| Minimum .NET Version ---|---|--- AbandonedCOMKeys|...

siofra

Summary Siofra is a tool designed to identify and exploit DLL hijacking vulnerabilities in Windows programs. It is able to simulate the Windows loader in order to give visibility into all of the dependencies and corresponding vulnerabilities of a PE on disk, or alternatively an image file in memo...

koppeling-p

koppeling-p Adaptive DLL hijacking / dynamic export forwarding - EAT preserve Overview This project is a limited, Python-only extension to the amazing project by Nick Landers @monoxgas, available here. Differences The only difference to the original project is that koppeling-p p stands for...

LdrLockLiberator

LdrLockLiberator For when DLLMain is the only way LdrLockLiberator is a collection of techniques for escaping or otherwise forgoing Loader Lock while executing your code from DllMain or anywhere else the lock may be present. It was released in conjunction with the "Perfect DLL Hijacking" article...

DLHell

DLHell DLHell performs DCOM local & remote Windows DLL Proxying. Install The following packages are required might depend on your distro, the following example is for Debian 12: sudo apt install -y g++-mingw-w64-x86-64-win32 binutils-mingw-w64-x86-64 Install pip dependencies: pip3 install -r...

CVE-2024-27518

CVE-2024-27518 - SUPERAntiSpyware Professional X LPE PoC This vulnerability was discovered and disclosed by M. Akil Gündoğan from Secunnix Vulnerability Research Team. This repository will hold the proof-of concept and advisories. Details: Product: SUPERAntiSpyware Professional X and all editions...

CS-DropSpawn_BOF

DropSpawn Introduction DropSpawn is a CobaltStrike BOF used to spawn additional Beacons via a relatively unknown method of DLL hijacking. Works x86-x86, x64-x64, and x86-x64/vice versa. Use as an alternative to process injection. Windows executables will follow the DLL search order when trying to...

CVE-2024-6769

Blogpost: CVE-2024-6769 Poisoning the activation cache to elevate from medium to high integrity This blog is about two chained bugs: Stage one is a DLL Hijacking bug caused by the remapping of ROOT drive and stage two is an Activation Cache Poisoning bug managed by the CSRSS server. The first sta...

CVE-2023-34312-exp

Disclaimer This project is created only for reproduction experiments. Affected Versions QQ 9.6.2.27855 9.7.11.29088 except QQ 9.7.10, because it does not come with QQProtect.exe apparently TIM 3.4.5.22071 3.4.7.22084 Usage After installing QQ/TIM, place the two malicious DLLs in the same folder a...

Enumprotections_BOF

Enumprotections BOF This BOF can be used to enumerate system processes and identify the protection level of each one. Additional information, like service relation, user, session, and path, are also returned. This information in combination can be used to identify good candidates to explore for...

IDiagnosticProfileUAC

IDiagnosticProfileUAC Just another UAC bypass using auto-elevated COM object Virtual Factory for DiagCpl 12C21EA7-2EB8-4B55-9249-AC243DA8C666. This COM object can be used to create instance of DiagnosticProfile D0B7E02C-E1A3-11DC-81FF-001185AE5E76 COM object which exposes SaveDirectoryAsCab metho...

CVE-2017-8464-exp-generator

CVE-2017-8464-exp-generator this tool can generate a exp for cve-2017-8486, it is developed by python Usage: CVE-2017-8464.py dllname then there will generate 26 files name as A.lnk,B.lnk,....,Z.lnk then you just need to put the dll file into any of the disk A:/,B:/,....,Z:/ for example, if you p...

DllShimmer

DllShimmer Weaponize DLL hijacking easily. Backdoor any function in any DLL without disrupting normal process operation. How it works DllShimmer parses the original DLL and extracts information about exported functions name, ordinal number, and forwarder info. Based on this information, DllShimme...

POC-of-CVE-2022-36271

POC-of-CVE-2022-36271 The name of an affected Product : Outbyte PC Repair Installation File The affected version : 1.7.112.7856 The CVE ID for the entry : CVE-2022-36271 Description: iertutil.dll is missing so an attacker can use a malicious dll with same name and can get a admin privileges and...