Auto-Elevate

Auto-Elevate This tool demonstrates the power of UAC bypasses and built-in features of Windows. This utility auto-locates winlogon.exe, steals and impersonates it's process TOKEN, and spawns a new SYSTEM-level process with the stolen token. Combined with UAC bypass method 41 ICMLuaUtil UAC bypass...

TokenUniverse

Token Universe Token Universe is an advanced tool for experimenting and researching Windows security mechanisms. It exposes UI for creating, viewing, impersonating, and modifying access tokens, spawning processes, managing Local Security Authority, checking available access and modifying security...

impacket

Impacket Copyright Fortra, LLC and its affiliated companies. All rights reserved. Impacket was originally created by SecureAuth, and now maintained by Fortra's Core Security. Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level...

pytmipe

PYTMIPE & TMIPE PYTMIPE PYthon library for Token Manipulation and Impersonation for Privilege Escalation is a Python 3 library for manipulating Windows tokens and managing impersonations in order to gain more privileges on Windows. TMIPE is the python 3 client which uses the pytmipe library...

MSSQLand

✈️ MSSQLand Land gracefully in your target Microsoft SQL Server MS SQL DBMS, as if arriving on a business-class flight with a champagne glass in hand. 🥂 MSSQLand is a C Microsoft SQL Server MSSQL / MS SQL post-exploitation tool built for red team operators. Designed to run inside the target...

SharpImpersonation

SharpImpersonation This was a learning by doing project from my side. Well known techniques are used to built just another impersonation tool with some improvements in comparison to other public tools. The code base was taken from: https://github.com/0xbadjuju/Tokenvator A blog post for the...

getSPNless

getSPNless Python tool to obtain Kerberos service tickets using the SPN-less technique. Based on Exploiting RBCD Using a Normal User Account. This tool uses the impacket project. Installation These tools are only compatible with Python 3.5+. Clone the repository from GitHub, install the...

undetected-httpx

undetected-httpx undetected-httpx is a multi-purpose HTTP probing toolkit inspired by httpx. It is specifically engineered to bypass modern anti-bot infrastructures by mimicking real-world browser signatures. Traditional HTTP clients are easily fingerprinted and blocked by WAFs. This tool leverag...

PhishingKitHunter

PhishingKitHunter Find phishing kits which use your brand/organization's files and image. PhishingKitHunter or PKHunter is a tool made for identifying phishing kits URLs used in phishing campains targeting your customers and using some of your own website files as CSS, JS, .... This tool - write ...

pypykatz

🚩 Sponsors If you like this project, consider purchasing licenses of OctoPwn, our full pentesting suite that runs in your browser! For notifications on new builds/releases and other info, hop on to our Discord pypykatz Mimikatz implementation in pure Python. At least a part of it : Runs on all OS...

awesome_windows_logical_bugs

awesomewindowslogicalbugs 创建这个仓库是为了想学习 Windows 逻辑权限提升漏洞的人。 同时我也添加了一些自己的发现。你可以通过 @404death 联系我，来添加我遗漏的好文章。 正在进行中（WIP），当新的漏洞发布时，我会持续更新这个仓库。 权限提升（漏洞及其他研究）： Windows 逻辑权限提升漏洞 特权文件操作漏洞到 SYSTEM shell（技术）： 任意目录删除到 SYSTEM shell 任意文件创建/写入到 SYSTEM shell 任意目录创建到 SYSTEM shell 服务账户到 SYSTEM 特权（令牌模拟）：...

sam-the-admin

利用CVE-2021-42278和CVE-2021-42287从标准域用户模拟DA 已知问题 它无法在Kali之外使用，我稍后会更新它 : 相关阅读 CVE-2021-42287/CVE-2021-42278武器化利用 sAMAccountName欺骗...

CVE-2022-26923

CVE-2022-26923 Como se describe en Tenable: Vulnerabilidad de elevación de privilegios en Active Directory Domain Services CVSS v3 Puntuación base: 8.8 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Gravedad: Alta Resumen: CVE-2022-26923 explota una vulnerabilidad en los Servicios de...

CVE-2026-20896

CVE-2026-20896：Gitea Docker 镜像认证绕过 PoC !WARNING 仅在本地实验室或针对您明确获得授权测试的系统上使用此 PoC。 https://github.com/user-attachments/assets/b73af2fe-0e59-438b-80d6-be93fd75697b 概述 CVE-2026-20896 是受影响官方 Gitea Docker 镜像中的认证绕过漏洞。当启用反向代理认证时，镜像生成的 REVERSEPROXYTRUSTEDPROXIES = 设置允许能够访问 Gitea 后端的客户端通过 X-WEBAUTH-USER...

CVE-2022-33891

CVE-2022-33891 - Apache Spark 命令注入漏洞 ⚠️ 仅用于教育和授权的安全研究目的 原始漏洞利用作者 非常感谢原始 PoC 作者 AkbarTrilaksana 描述 Apache Spark UI 提供了通过配置选项 spark.acls.enable 启用 ACL 的功能。借助身份验证过滤器，它可以检查用户是否具有查看或修改应用程序的访问权限。如果启用了 ACL，HttpSecurityFilter 中的一条代码路径可能允许某人通过提供任意用户名来执行身份冒充。恶意用户随后可能能够访问一个权限检查函数，该函数最终会根据其输入构建 Unix shell...

RottenPotato

This code is no longer maintained - for a newer implementation see https://github.com/breenmachine/RottenPotatoNG RottenPotato Local Privilege Escalation from Windows Service Accounts to SYSTEM For a technical overview of this exploit see our blog post at...

NamedPipePTH

NamedPipePTH This project is a PoC code to use Pass-the-Hash for authentication on a local Named Pipe user Impersonation. There also is a blog post for explanation: https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/ It is heavily based on the code from the projects Invoke-SMBExec.ps1 and RoguePotat...

CVE-2018-0952-SystemCollector

SystemCollector Windows 10 诊断中心标准收集器服务中权限提升的概念验证（PoC） 受影响产品 Windows 10 Windows Server Windows Server 2016 Visual Studio 2015 Update 3 Visual Studio 2017 摘要 由于 DiagnosticsHub.StandardCollector.Runtime.dll 中缺少客户端模拟功能，Windows 标准收集器服务所使用的诊断中心打包库可以被强制将任意文件复制到任意位置。 以下是关于如何发现和利用此漏洞的详细说明：Windows...

RogueWinRM

RogueWinRM RogueWinRM is a local privilege escalation exploit that allows to escalate from a Service account with SeImpersonatePrivilege to Local System account if WinRM service is not running default on Win10 but NOT on Windows Server 2019. Briefly, it will listen for incoming connection on port...

CVE-2026-54121-CertiGhost

CVE-2026-54121 Certighost - 修复版 fork 这是针对 CVE-2026-54121（又称 Certighost ）的概念验证工具的一个可用 fork。 原始研究与 PoC 由 @H0j3n 和 @aniqfakhrul 完成，详细分析见： https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26。 此 fork 修复了 SAN 处理问题——该问题会阻止 PKINIT 在遵循所请求 SAN 的 CA 上成功；强化了 --target-san 的解析；并重新设计了计算机账户的处理方式，使其不再耗...