BitUnlocker

BitUnlocker Downgrade Attack A proof of concept for accessing BitLocker-encrypted disks in under 5 minutes on fully patched Windows 11 machines through a boot manager downgrade attack, leveraging the SDI vulnerability originally documented as CVE-2025-48804. The July 2025 patch fixes this in...

lsarelayx

lsarelayx Introduction lsarelayx is system wide NTLM relay tool designed to relay incoming NTLM based authentication to the host it is running on. lsarelayx will relay any incoming authentication request which includes SMB. Since lsarelayx hooks into existing application authentication flows, the...

CVE-2019-17147_Practice_Material

CVE-2019-17147PracticeMaterial This repo contains dumped flash partitions with firmware version vulnerable to CVE-2019-17147, and some useful binaries to downgrade and debug your WR841NV14 router. Doing hardware modifications such as overwriting flash chip partitions have its risks. Evaluate the...

knob

README Repository about the Key Negotiation Of Bluetooth KNOB attacks on Bluetooth BR/EDR and Bluetooth Low Energy. Related Work From the Bluetooth Standard to Standard-Compliant 0-days HWIO20 Key Negotiation Downgrade Attacks on Bluetooth and Bluetooth Low Energy TOPS20 Bluetooth blues: KNOB...

ams-failopen

Fail-Open Signing in AppleMediaServices Zero-Day Disclosure Summary This issue constitutes a live Zero-Day vulnerability and reflects a systemic design flaw in AppleMediaServices.framework, rather than a regression or version-specific bug. A critical fail-open flaw in Apple’s AppleMediaServices...

Advanced-Loader-Reverse-Engineering

From Shellhost to 3 DLLs: Analyzing an Advanced Loader with Payload Injection, CFG Bypass, and Downgrade Attacks Overview This analysis covers a sophisticated multi-phase loader targeting Shellhost.exe, amsi.dll, mstscax.dll, and clbcatq.dll. The loader uses module stomping, CFG bypass, COM...

imposter

IMPOSTER A pentest tool used to attack windows clients on rogue networks. Current version Features Downgrade LDAP to NTLM authentication Fake initial steps of an domain controller to fool Network Location Awareness Servers DNS, CLDAP, LDAP Setup The current version have been tested on Kali Linux...

unicorn

unicorn Written by: Dave Kennedy @HackingDave Website: https://www.trustedsec.com Magic Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's powershell attacks and the powershell bypass technique presented by David...

http-request-smuggler

HTTP Request Smuggler This Burp Suite extension automatically detects and exploits HTTP Request Smuggling vulnerabilities using advanced desynchronization techniques developed by PortSwigger researcher James Kettle. It supports comprehensive scanning for HTTP/1.1 and HTTP/2-downgrade desync...

smugglefuzz

SmuggleFuzz SmuggleFuzz, a configurable and rapid HTTP downgrade smuggling scanner. Empowering users with customizable gadget lists, it offers deeper insights into the reasons behind failed smuggling attacks. I am confident that numerous HTTP downgrade-based smuggling vulnerabilities remain...

NetNTLMtoSilverTicket

SpoolSample - NetNTLMv1 - NTLM - Silver Ticket This technique has been alluded to by others, but I haven't seen anything cohesive out there. Below we'll walk through the steps of obtaining NetNTLMv1 Challenge/Response authentication, cracking those to NTLM Hashes, and using that NTLM Hash to sign...

EUVD-2026-73973

In btmsecencryptchange of btmsec.cc, there is a possible downgrade attack due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28627

CVE-2026-28627 affects Android's Bluetooth stack , specifically the btm_sec_encrypt_change function in btm_sec.cc. A logic error in this code allows a downgrade attack , which can lead to remote information disclosure without requiring additional execution privileges or user interaction. The vuln...

Seth

Seth Seth is a tool written in Python and Bash to MitM RDP connections by attempting to downgrade the connection in order to extract clear text credentials. It was developed to raise awareness and educate about the importance of properly configured RDP connections in the context of pentests,...

CVE-2026-22002-VNC-Authentication-Bypass-via-Protocol-Version-Confusion

CVE-2026-22002 – VNC Authentication Bypass via Protocol Version Confusion Program Code Python root@kitploit: vncserversim.py - VNC server with version negotiation flaw import socket, struct def handleconn: Send server version "RFB 003.008\n" conn.sendb"RFB 003.008\n" Receive client version...

SMBetray

SMBetray Version 1.0.0. This tool is a PoC to demonstrate the ability of an attacker to intercept and modify insecure SMB connections, as well as compromise some secured SMB connections if credentials are known. Background Released at Defcon26 at "SMBetray - Backdooring and Breaking Signatures" I...

CVE-2019-19652

CVE-2019-19652 Chevereto downgrade attack - 1.0.0 - 1.1.4 Free, = 3.13.5 Core. An admin user can instruct the updater script to downgrade to another version instead of upgrade, reintroducing previous flaws. Due to the lack of a CSRF token this attack can also be used in a CSRF attack, meaning an...

CVE-2024-3094

CVE-2024-3094 Affected version : xz-5.6.0 or xz-5.6.1 Solution : downgrade xz from 5.6.0 to 5.4.6. xz-backdoor.md CVE-2024-3094 Checker...

cve-2024-3094-detect

CVE-2024-3094-detect XZ Utils Vulnerability Check and Downgrade Script This script is designed to check the version of XZ Utils installed on your Linux system and downgrade it to a safe version if necessary. It also detects the Linux distribution and the package manager used. Features Checks the...

unicorn

unicorn 作者：Dave Kennedy @HackingDave 网站：https://www.trustedsec.com Magic Unicorn 是一个简单工具，用于实施 PowerShell 降级攻击并将 shellcode 直接注入内存。基于 Matthew Graeber 的 PowerShell 攻击方法以及 David Kennedy（TrustedSec）和 Josh Kelly 在 Defcon 18 上展示的 PowerShell 绕过技术。 使用非常简单，只需运行 Magic Unicorn（确保已安装 Metasploit 且路径正确），Magic...