CrystalPotato

CrystalPotato Crystal port of GodPotato, a local privilege escalation from accounts with SeImpersonatePrivilege to SYSTEM. It works by abusing the DCOM OXID Resolver and named pipe impersonation. Windows APIs are resolved dynamically and invoked through indirect syscall stubs, all strings are...

SharpEfsPotato

SharpEfsPotato Local privilege escalation from SeImpersonatePrivilege using EfsRpc. Built from SweetPotato by @EthicalChaos and SharpSystemTriggers/SharpEfsTrigger by @cube0x0. Usage C:\tempSharpEfsPotato.exe -h SharpEfsPotato by @bugch3ck Local privilege escalation from SeImpersonatePrivilege...

ProxyLogon

ProxyLogon ProxyLogon is the formally generic name for CVE-2021-26855, a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin. We have also chained this bug with another post-auth arbitrary-file-write vulnerability,...

impacket

Impacket Copyright Fortra, LLC and its affiliated companies. All rights reserved. Impacket was originally created by SecureAuth, and now maintained by Fortra's Core Security. Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level...

CVE-2026-54121-Certighost

🛡 AI Security Tool Module CVE-2026-54121: Active Directory Certificate Services Impersonation Certighost Official Security Audit Module for AI Security Tool Ecosystem 🌐 Web Demo • 📚 Project Website • 💬 Community Chat Website Navigation: Home • Updates • Downloads • Modules 🧠 Conceptual Overview...

CVE-2026-20896

CVE-2026-20896: Gitea Docker Image Authentication Bypass PoC !WARNING Use this PoC only in a local lab or against a system you are explicitly authorized to test. https://github.com/user-attachments/assets/b73af2fe-0e59-438b-80d6-be93fd75697b Overview CVE-2026-20896 is an authentication bypass in...

PetitPotato

PetitPotato Local privilege escalation via PetitPotam Abusing impersonate privileges. Description PetitPotam uses MS-EFSR Encrypting File System Remote, a protocol used to perform maintenance and management operations on encrypted data stored remotely and accessed over a network. There are a seri...

PhishingKitHunter

PhishingKitHunter Find phishing kits which use your brand/organization's files and image. PhishingKitHunter or PKHunter is a tool made for identifying phishing kits URLs used in phishing campains targeting your customers and using some of your own website files as CSS, JS, .... This tool - write ...

Masky

Masky Masky is a python library providing an alternative way to remotely dump domain users' credentials thanks to an ADCS. A command line tool has been built on top of this library in order to easily gather PFX, NT hashes and TGT on a larger scope. This tool does not exploit any new vulnerability...

pypykatz

🚩 Sponsors If you like this project, consider purchasing licenses of OctoPwn, our full pentesting suite that runs in your browser! For notifications on new builds/releases and other info, hop on to our Discord pypykatz Mimikatz implementation in pure Python. At least a part of it : Runs on all OS...

bluffs

BLUFFS Introduction This repository contains code related to BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses. Paper abstract Bluetooth is a pervasive technology for wireless communication. Billions of devices use it in sensitive applications and to exchange private data. The...

BackupCreds

BackupCreds | | | | | | | Dump all the Creds! | | | | | | | | | | | | Lefteris lefty Panos | || Abusing SeTrustedCredmanAccessPrivilege to dump user creds The program provides the ability to dump the stored credentials a user might have in the Windows Credential Manager. It is a useful technique ...

CVE-2026-54121

CVE-2026-54121 Certighost This is a proof-of-concept tool to demonstrace CVE-2026-54121 a.k.a Certighost. Read here https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26 for the detailed analysis. Install dependencies The proof of concept is a self-contained Python script. It requires...

RunasCs

RunasCs RunasCs is an utility to run specific processes with different permissions than the user's current logon provides using explicit credentials. This tool is an improved and open version of windows builtin runas.exe that solves some limitations: Allows explicit credentials Works both if...

CVE-2026-73317

CVE-2026-73317: Approval job authorization bypass XenForo before 2.3.13 lets an administrator with only the cache-rebuild permission dispatch an approval job as another user. What happens The ACP rebuild endpoint accepts a caller-supplied job class and options. Its authorization check asks only...

TokenUniverse

Token Universe Token Universe is an advanced tool for experimenting and researching Windows security mechanisms. It exposes UI for creating, viewing, impersonating, and modifying access tokens, spawning processes, managing Local Security Authority, checking available access and modifying security...

sam-the-admin

Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user Known issues it will not work outside kali , i will update it later on : Check out CVE-2021-42287/CVE-2021-42278 Weaponisation sAMAccountName spoofing...

DCOMPotato

Exploit collection for some Service DCOM Object local privalege escalation vulnerabilityby SeImpersonatePrivilege abuse writeup DCOM use RPCCIMPLEVELIDENTIFY as default impersonation level, for the default out-bound IUnknown call, see...

awesome_windows_logical_bugs

awesomewindowslogicalbugs Created this repo for the people who want to learn about windows logical privilege escalation bugs. And also I added some of my findings. You can contact me via @404death to add good article which I missed. work in progress WIP , I'm always update this repo when the new...

CVE-2026-114617

A flaw was found in Authlib. When validating OpenID Connect OIDC identity tokens, the library improperly relies on a claim within the incoming token to decide whether to enforce nonce verification, which binds the token to an active session. A remote attacker with a captured, validly signed token...