CLR-Unhook

CLR Unhooking Tool Note: For this to have the effect of a clean CLR, you’d need to manually map the DLL from disk into memory. You cannot use LoadLibraryA/W, because antivirus solutions will detect the DLL load event and may hook it immediately. If you want this behavior, you can look up existing...

CVE-2021-40444

CVE-2021-40444 PoC Malicious docx generator to exploit CVE-2021-40444 Microsoft Office Word Remote Code Execution Creation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 docx file You need to...

DexLoader

⚡Dex Loader Android This project demonstrates different methods of loading and executing DEX files in Android, with a focus on dynamic loading techniques such as DexClassLoader, PathClassLoader, and in-memory execution. 📦 Project Structure Dex Loader : Loads and executes contacts.dex, which...

PowerShx

SharpShx Unmanaged PowerShell execution using DLLs or a standalone executable. Introduction PowerShx is a rewrite and expansion on the PowerShdll project. PowerShx provide functionalities for bypassing AMSI and running PS Cmdlets. Features Run Powershell with DLLs using rundll32.exe,...

Nim-RunPE

Nim-RunPE A Nim implementation of reflective PE-Loading from memory. The base for this code was taken from RunPE-In-Memory - which I ported to Nim. You'll need to install the following dependencies: nimble install ptrmath winim I did test this with Nim Version 1.6.2 only, so use that version for...

FsquirtCPLPoC

Fsquirt.exe Windows binary attempts to load a Control Panel applet CPL called bthprops.cpl from its current working directory. When bthprops.cpl is present alongside fsquirt.exe, the binary loads it and executes a MessageBox from DLLMain. This PoC code generates a malicious bthprops.cpl file that...

HAFNIUM-Microsoft-Exchange-0day

Recursos interesantes CheckMyOWA ¿Qué es? Creamos este sitio para ayudar a notificar a las víctimas basándonos en listas de servidores Exchange comprometidos con Outlook Web Access OWA habilitado, que fueron obtenidas de los perpetradores de este evento de violación masiva. Esto incluye...

CVE-2021-44228

CVE-2021-44228 Creo que esta historia es más práctica llorandochristophetd/log4shell-vulnerable-app Solo lo investigué por impulso y curiosidad, por lo que probablemente haya partes ambiguas o errores. Por favor, hazlo bajo tu propia responsabilidad. Crear el entorno de reproducción. Se espera qu...

CVE-2020-14372

CVE-2020-14372: Eludiendo no tan Secure Boot con un "simple truco" Detalles de la vulnerabilidad Un día escribí "help" en la consola de GRUB2 y vi algunos comandos muy "divertidos": readbyte ADDR: Lee un valor de 8 bits desde ADDR writebyte ADDR VAL: Escribe un valor de 8 bits VAL en ADDR...

CPLDCOMTrigger

CPLDCOMTrigger Description A Python script depends on Impacket scripts to trigger the loading of a .cpl file into memory using a DCOM object. The CPL file path must already be added to the registry. The script uses the Open function in the IOpenControlPanel interface to load the CPL Control Panel...

The vulnerability of the OpenSky flight planning and operational management system, related to unlimited loading of dangerous file types, allows a perpetrator to execute arbitrary commands.

The vulnerability of the OpenSky flight planning and operational management system lies in its ability to load files of a dangerous type without limitation. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code...

OVSwrap-CVE-2026-64531-Mitigation-Tool

Herramienta de Mitigación OVSwrap CVE-2026-64531 Un script sencillo que detecta y mitiga la vulnerabilidad OVSwrap que afecta a los módulos del kernel de Open vSwitch. Características Detecta módulos vulnerables de Open vSwitch Determina si el módulo está cargado Bloquea la carga automática Elimi...

BOF_RunPe

BOFRunPE BOF RunPE is a Beacon Object File for Cobalt Strike that executes PE files entirely in-memory within the beacon process. Unlike traditional fork&run, no child process is spawned, no console is created, and no pipe is used - all output is captured via IAT hooking and redirected to the...

PowerSharpPack

Sponsored by PowerSharpPack Many useful offensive CSharp Projects wraped into Powershell for easy usage. Why? In my personal opinion offensive Powershell is not dead because of AMSI, Script-block-logging, Constrained Language Mode or other protection features. Any of these mechanisms can be...

HeaderLessPE

HeaderLessPE Introduction 中文 HeaderLessPE is a memory PE loading technique used by the Icedid Trojan. Based on this technology, we propose a new way of file-less attack using HVNC . This enhancement allows to inject HeaderLessPE into execute graphical hacking tools without limitations. Compared t...

Analysis

Detection Engineering Notes and Analysis This repository documents hands on detection research based on lab testing, log analysis, and real SOC workflows. The focus is on how attacker techniques actually appear in logs, what detection logic works in practice, what fails, and where false positives...

SharpPN

C PrintNightmare CVE-2021-1675 Necesitarás una DLL para usar SharpPN. Así que una vez que la tengas, solo compila y especifica la ruta de la DLL en los argumentos de la línea de comandos. Compilación Puedes compilarlo tú mismo con C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe -out:SharpPN.exe...

CVE-2022-31691

CVE-2022-31691 Un análisis de mi hasta ahora inconcluyente investigación sobre CVE-2022-31691. Antecedentes Soy usuario frecuente de Spring Tool Suite STS para Eclipse y suelo confiar en él para inicializar nuevos proyectos Spring Boot. Esta vulnerabilidad ver...

CVE-2021-1675-LPE-EXP

CVE-2021-1675-LPE-EXP Simple LPE Exploit of CVE-2021-1675 Usage root@kitploit: CVE-2021-1675-LPE.exe C:\test\MyPigDLL.dll MyPigDLL.dll,is a test DLL which will create C:\test.txt if succeed Notice 1. Add EnumPrinterDriversW for get pDriverPath, so We dont need change the "hardcode Driver path"...

upx

ooooo ooo ooooooooo. ooooooo ooooo 888' 8' 888 Y88. 8888 d8' 888 8 888 .d88' Y888..8P 888 8 888ooo88P' 8888' 888 8 888 .8PY888. 88. .8' 888 d8' 888b YbodP' o888o o888o o88888o root@kitploit: The Ultimate Packer for eXecutables Copyright c 1996-2026 Markus Oberhumer, Laszlo Molnar & John Reiser...