KeePass-CVE-2023-32784-Exploitation-and-Defense

KeePass Memory Leak Vulnerability CVE-2023-32784:Exploitation & Defense Architecture Objective To analyse the CVE-2023-32784 vulnerability in KeePass Password Safe v2.53, demonstrate master password extraction via memory dumping, and engineer robust detection and mitigation controls. The...

GhostKatz

GhostKatz Extract LSASS credentials directly from physical memory by abusing signed vulnerable drivers with physical memory read primitives via MmMapIoSpace, bypassing traditional user-mode detection capabilities. This tool was developed in collaboration between Julian Peña and Eric Esquivel. Thi...

Memory-analysis

Memory-analysis Contains tools to perform malware and forensic analysis in Memory. Plugins: Dyrescan.py - parses Dyreconfig in memory. Rat9002.py - parses 9002 rat config in memory. plugx.py - parses plugx config in memory modified to also parse config size: 0x170c. ghostrat.py - parses ghostrat...

blindsight

blindsight "There's no such things as survival of the fittest. Survival of the most adequate, maybe. It doesn't matter whether a solution's optimal. All that matters is whether it beats the alternative." -- Peter Watts, Blindsight 2006 Red teaming tool to dump LSASS memory, bypassing basic...

autotimeliner

AutoTimeliner Automagically extract forensic timeline from volatile memory dumps. AutoTimeliner runs multiple Volatility3 plugins against Windows, Linux, and macOS memory images, then merges their output into a single, sorted CSV timeline: Generic Timeline Plugin Plugin| What it captures ---|---...

CVE-2020-16938

CVE-2020-16938 CVE-2020-16938 is a vulnerability that allows you to get unrestricted file read capabilities on the entire disk as unprivileged user. The bug was originally found and reported by my friend Jonas. His PoC can be found here. My version of the exploit consists of a bunch of Windows AP...

LinkedInDumper

LinkedInDumper Script de Python 3 para volcar empleados de empresas desde la API de LinkedIn 💬 Descripción LinkedInDumper es un script de Python 3 que vuelca datos de empleados desde la plataforma de redes sociales LinkedIn. Los resultados incluyen nombre, apellido, cargo puesto, ubicación y un...

The vulnerability of the pg_dump utility in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

adwsdomaindump

ADWSDomainDump Volcador de información de Active Directory a través de ADWS Active Directory Web Services. Instalación Instalación recomendada: root@kitploit: pipx install git+https://github.com/mverschu/adwsdomaindump o pipx install . Uso root@kitploit: adwsdomaindump -u 'corp.local\jsmith' -p...

POSTDump

POSTDump Otra herramienta para realizar minidump del proceso LSASS usando algunas técnicas para evitar la detección. POSTDump es la implementación en C / .NET de la función minidump de ReactOS como nanodump, evitando así la llamada a la función MiniDumpWriteDump de la API de Windows. El código de...

MultiDump

MultiDump MultiDump es una herramienta de post-explotación escrita en C para volcar y extraer la memoria de LSASS discretamente, sin activar alertas de Defender, con un manejador escrito en Python. Entrada de blog: https://xreous.io/posts/multidump MultiDump soporta el volcado de LSASS mediante...

certsync

certsync certsync is a new technique in order to dump NTDS remotely, but this time without DRSUAPI : it uses golden certificate and UnPAC the hash. It works in several steps: 1. Dump user list, CA informations and CRL from LDAP 2. Dump CA certificate and private key 3. Forge offline a certificate...

certsync

certsync certsync es una nueva técnica para volcar NTDS de forma remota, pero esta vez sin DRSUAPI : utiliza golden certificate y UnPAC the hash. Funciona en varios pasos: 1. Volcar lista de usuarios, información de CA y CRL desde LDAP 2. Volcar certificado de CA y clave privada 3. Forjar fuera d...

nmap-CVE-2023-23333-exploit

nmap-CVE-2023-23333-exploit Nmap NSE script to dump /etc/passwd from remote system using Solarwinds CVE-2023-23333 vulnerability Save the script into a file named solar-CVE-2023-23333.nse. To run the script, you can use Nmap's --script-args option to provide the output file path: nmap -p --script...

HiveJack

HiveJack This tool can be used during internal penetration testing to dump Windows credentials from an already-compromised host. It allows one to dump SYSTEM, SECURITY and SAM registry hives and once copied to the attacker machines provides an option to delete these files to clear the trace. Ofte...

seccomp-tools

Seccomp Tools Powerful tools for seccomp analysis. This project is aimed primarily but not exclusively at analyzing seccomp sandboxes in CTF pwn challenges. Some features are CTF-specific, but they're just as useful for analyzing real-world seccomp filters. Features Dump - Automatically dumps...

WSASS

WSASS This is a tool that uses the old WerfaultSecure.exe program to dump the memory of processes protected by PPL Protected Process Light, such as LSASS.EXE. The output is in Windows MINIDUMP format. This tool automatically replaces the"MDMP" magic header with a PNG magic header. After the dump ...

CobaltStrikeParser

CobaltStrikeParser Analizador Python para la configuración de Beacons de CobaltStrike Descripción Use parsebeaconconfig.py para beacons sin etapa, volcados de memoria o URLs C2 con modo de compatibilidad con metasploit predeterminado true. Muchos beacons sin etapa son PE donde el propio código de...

CVE-2026-98029

eth: nfp: bound the ntuple rule dump by the caller's buffer size...

CVE-2026-97901

The Linux kernel contains a vulnerability in the generic netlink controller where the policy dump keeps pointers to a target family's operation and policy tables in its callback state. Because Netlink only pins the module owning the dump callback (the controller's owner) rather than the target fa...