CVE-2024-54363

CVE-2024-54363 Wp NssUser Register successful, just Check this: Login...

CVE-2017-8890

CVE-2017-8890 相关文档： ubuntu 内核双机调试方法 CVE-2017-8890漏洞分析和利用-概览篇 CVE-2017-8890 漏洞分析 原理篇 CVE-2017-8890 漏洞利用（root ubuntu 16.04@kernel 4.10） CVE-2017-8890 漏洞利用 root nexus6p@kernel 3.10...

CVE-2017-16995

CVE-2017-16995 记录一下自己折腾的CVE-2017-16995漏洞和相关分析 （希望能自己找个，笑 概述 此漏洞由于bpf虚拟执行时，校验器分支判断错误所引起的LPE 原理上是整数扩展漏洞 分析 触发 https://ph4ntonn.github.io/CVE-2017-16995-trigger.html 利用 https://ph4ntonn.github.io/CVE-2017-16995-exploit.html 结构 https://ph4ntonn.github.io/CVE-2017-16995-structure.html EXP 此处下载，请自行编译...

CVE-2020-1472

CVE-2020-1472 CVE-2020-1472复现时使用的py文件整理打包 examples路径下为exp文件所在目录，其他为导入包，忽略即可 对应博客记录文章：https://www.svenbeast.com/post/fu-xian-cve-2020-1472-netlogon-te-quan-ti-sheng-lou-dong/...

CVE-2020-1472

Windows NetLogon 権限昇格脆弱性の再現（CVE-2020-1472） impacket.zipを現在のフォルダに解凍する必要があります。 最新のimpacketパッケージはこちらからダウンロードできます：https://github.com/SecureAuthCorp/impacket 具体的な手順は記事を参照：https://mp.weixin.qq.com/s/8rp0k5M2aPSPIXxVuIRMdQ 参考 https://github.com/dirkjanm/CVE-2020-1472...

invoker

Invoker Penetration testing utility and antivirus assessment tool. Built with Visual Studio Community 2022 v17.5.4 64-bit and tested on Windows 10 Enterprise OS 64-bit. Made for educational purposes. I hope it will help! This repository started to have known signatures and I don't have time to...

pickl3

Pickl3 Pickl3 es una herramienta de phishing de credenciales de usuario activo de Windows. Puedes ejecutar Pickl3 y realizar phishing de la credencial del usuario objetivo. Uso Operativo - 1 Hoy en día, dado que el sistema operativo de muchos usuarios finales es Windows 10, no podemos robar...

gitoops

GitOops! 😱 all paths lead to clouds GitOops is a tool to help attackers and defenders identify lateral movement and privilege escalation paths in GitHub organizations by abusing CI/CD pipelines and GitHub access controls. It works by mapping relationships between a GitHub organization and its CI/...

Privilege_Escalation

PrivilegeEscalation An windows UAC Bypass made simple 😋 Features Auto bypass for Windows 7/8/10 Manual bypass Failsafe delete all registry key made from Privilege Escalation Build root@kitploit: git clone https://github.com/Mrakovic-ORG/PrivilegeEscalation cd PrivilegeEscalation\PrivilegeEscalati...

Sherlock

Deprecated. Have a look at Watson instead. Sherlock PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities. Currently looks for: MS10-015 : User Mode to Ring KiTrap0D MS10-092 : Task Scheduler MS13-053 : NTUserMessageCall Win32k Kernel Pool...

Vulmap

Vulmap is an open-source online local vulnerability scanner project. It consists of online local vulnerability scanning programs for Windows and Linux operating systems. These scripts can be used for defensive and offensive purposes. It is possible to make vulnerability assessments using these...

portia

⚠️ NOTE: This tool is no longer under active maintenance. portia Portia aims to automate a number of techniques commonly performed on internal network penetration tests after a low privileged account has been compromised Privilege escalation Lateral movement Convenience modules Portia is a genus o...

Perfusion

Perfusion Windows 7 、Windows Server 2008R2 、Windows 8 、Windows Server 2012 では、RpcEptMapper および DnsCache（7/2008R2 のみ）サービスのレジストリキーに弱いアクセス許可が設定されています。任意のローカルユーザーが Performance サブキーを作成し、 Windows パフォーマンスカウンター を利用して、WMI サービスのコンテキストで NT AUTHORITY\SYSTEM として任意の DLL をロードできます（これがツール名の由来です）。...

dazzleUP

dazzleUP A tool that detects the privilege escalation vulnerabilities caused by misconfigurations and missing updates in the Windows operating systems. dazzleUP detects the following vulnerabilities. Exploit Checks The first feature of dazzleUP is that it uses Windows Update Agent API instead of...

PrintSpoofer

PrintSpoofer From LOCAL/NETWORK SERVICE to SYSTEM by abusing SeImpersonatePrivilege on Windows 10 and Server 2016/2019. For more information: https://itm4n.github.io/printspoofer-abusing-impersonate-privileges/. Usage You can check the help message using the -h option. root@kitploit:...

FullPowers

FullPowers FullPowers is a Proof-of-Concept tool I made for automatically recovering the default privilege set of a service account including SeAssignPrimaryToken and SeImpersonate. Rationale On Windows, some services executed as LOCAL SERVICE or NETWORK SERVICE are configured to run with a...

UsoDllLoader

UsoDllLoader ⚠️ 2020-06-06 Update: this trick no longer works on the latest builds of Windows 10 Insider Preview. This means that, although it still works on the mainstream version of Windows 10 , you should expect it to be patched in the coming months. Description This PoC shows a technique that...

Watson

Watson Watson is a .NET tool designed to enumerate missing KBs and suggest exploits for Privilege Escalation vulnerabilities. Supported Versions Windows 10 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004 Server 2016 & 2019 Usage root@kitploit: C:\ Watson.exe / / /\ \ \ | | \ / / / | /...

flare-qdb

FireEye Labs Query-Oriented Debugger flare-qdb is a command-line and scriptable Python-based tool for evaluating and manipulating native program state. It uses Vivisect to set a breakpoint on each queried instruction and executes Python code when hit. flare-qdb frees the analyst to take a nonline...

Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284

Remoto root@kitploit: git clone https://github.com/6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284.git && cd Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284 && gcc -O0 -Wall -o exp exp.c -lutil && ./exp root@kitploit: git clone...