AxHunter

AxHunter PoCs for Wellbia XIGNCODE3 anti-cheat xhunter driver family — xhunter1.sys v2023.12.7.78 CVE-2026-3609 and xhunter2.sys v2026.6.1.192 CVE-2026-15430. Workspace layout Cargo workspace, three crates: root@kitploit: AxHunter/ ├── Cargo.toml workspace manifest ├── axhunter-lsa/ shared crate ...

mimikatz-missing-manual

The Mimikatz Missing Manual The definitive guide to Windows Identity, Kerberos, and PKI Research. Originally developed as a private, high-end training curriculum for security conferences, this material is now being released to the public. Much of the technical depth and internal logic documented...

PowershellKerberos

PowershellKerberos Some scripts to abuse kerberos using Powershell. Check how to use video Thanks to @BRIPWN YouTube Injector.ps1 Small tool for injecting kerberos tickets. Supports two work modes: U can read ticket from kirbi file 1 mode U can read ticket from b64 2 mode Examples: root@kitploit:...

lsarelayx

lsarelayx Introducción lsarelayx es una herramienta de retransmisión NTLM a nivel de sistema diseñada para retransmitir las autenticaciones NTLM entrantes al host en el que se ejecuta. lsarelayx retransmitirá cualquier solicitud de autenticación entrante, incluyendo SMB. Dado que lsarelayx se...

lsawhisper-bof

LSA Whisperer BOF A Cobalt Strike Beacon Object File BOF port of LSA Whisperer — the tool that talks directly to Windows authentication packages through the LSA untrusted/trusted client interface, without touching LSASS process memory even when PPL and Credential Guard is enabled. Why This Exists...

silph

SILPH: Stealthy In-Memory Local Password Harvester SILPH is an open-source red team tool designed to dump LSA secrets, SAM hashes, and DCC2 credentials entirely in memory, without writing any files to disk. Unlike its upstream project go-secdump , SILPH is built to be integrated into the Orsted C...

Wonka

Wonka 🍫 "We are the music makers, and we are the dreamers of dreams." - Willy Wonka Wonka is a sweet Windows tool that extracts Kerberos tickets from the Local Security Authority LSA cache. Like finding a ticket, but for security research and penetration testing! 🎫 ✨ Features 🔐 System...

go-secdump

go-secdump Description Package go-secdump is a tool built to remotely extract hashes from the SAM registry hive as well as LSA secrets and cached hashes from the SECURITY hive without any remote agent and without touching disk. The tool is built on top of the library go-smb and use it to...

TokenUniverse

Token Universe Token Universe es una herramienta avanzada para experimentar e investigar los mecanismos de seguridad de Windows. Expone una interfaz de usuario para crear, visualizar, suplantar y modificar tokens de acceso, generar procesos, gestionar la Autoridad de Seguridad Local, verificar el...

DuplicateDump

DuplicateDump DuplicateDump es un fork de MirrorDump con las siguientes modificaciones: Implementación de DInovke Plugin DLL de LSA escrito en C++ que se puede limpiar después de volcar LSASS. MirrorDump compila el plugin de LSA como un ensamblado .NET que no se descargaría del proceso LSASS. Por...

SharpSecDump

SharpSecDump .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py. By default runs in the context of the current user. Please only use in environments you own or have permission to test against : Uso SharpSecDump.exe -target=192.168.1.15 -u=admin...

go-secdump

go-secdump 설명 go-secdump 패키지는 SAM 레지스트리 하이브에서 해시를 원격으로 추출하고, SECURITY 하이브에서 LSA 시크릿 및 캐시된 해시를 원격 에이전트 없이 디스크에 쓰지 않고 추출하도록 설계된 도구입니다. 이 도구는 go-smb 라이브러리 위에 구축되었으며, 이를 사용하여 Windows 원격 레지스트리와 통신하여 메모리에서 직접 레지스트리 키를 검색합니다. 이 도구는 학습 경험과 SAM 하이브에서 NT 해시, LSA 시크릿, 도메인 캐시 자격 증명을 레지스트리 하이브를 먼저 디스크에 저장한 후...

GIUDA

GIUDA GET a TGS on behalf of another user without password Scenario: you are Local Administrator and there is a logged User you want to Impersonate! Chain: SeTcbPrivilege allows you to read LSA storage, extract the SESSION KEY from TGT, and forge a request asking for a TGS; You must use LUID...

CVE-2023-21817

CVE-2023-21817 - Windows Kerberos LPE Vulnerability Checker A minimalist C++ Proof of Concept PoC / Vulnerability Checker for CVE-2023-21817. This utility helps security researchers and system administrators determine whether a Windows system is vulnerable to the Kerberos Local Privilege Escalati...

PPLdump

PPLdump ⚠️ 2022-07-24 - A partir de Windows 10 21H2 10.0.19044.1826 actualización de julio de 2022, el exploit implementado en PPLdump ya no funciona. Un parche en NTDLL ahora evita que los PPL carguen Known DLLs. Más información aquí. Esta herramienta implementa un exploit en espacio de usuario...

NtDumpBOF

NtDumpBOF BOF port of the tool https://github.com/ricardojoserf/NativeDump written by @ricardojoserf. Import NtDump.cna and run: root@kitploit: ntdump The minidump file will be created in memory and downloaded using CALLBACKFILE and CALLBACKFILEWRITE. Once downloaded the file will be visible at...

CVE-2026-69594

Heap-based buffer overflow in Microsoft Local Security Authority Server lsasrv allows an authorized attacker to elevate privileges locally...

CVE-2026-69277

Stack-based buffer overflow in Microsoft Local Security Authority Server lsasrv allows an authorized attacker to elevate privileges locally...

EUVD-2026-73476

Out-of-bounds read in Microsoft Local Security Authority Server lsasrv allows an authorized attacker to elevate privileges over a network...

EUVD-2026-73429

Stack-based buffer overflow in Microsoft Local Security Authority Server lsasrv allows an authorized attacker to elevate privileges locally...