CobaltStrikeParser

CobaltStrikeParser Python parser for CobaltStrike Beacon's configuration Description Use parsebeaconconfig.py for stageless beacons, memory dumps or C2 urls with metasploit compatibility mode default true. Many stageless beacons are PEs where the beacon code itself is stored in the .data section...

lmg

Linux Memory Grabber A script for dumping Linux memory and creating VolatilityTM profiles. Hal Pomeranz [email protected], 2020-02-01 THANKS! "If I have seen further it is by standing on the shoulders of giants." Issac Newton There are a lot of people who deserve thanks for making this simpl...

DuplicateDump

DuplicateDump DuplicateDump is a fork of MirrorDump with following modifications: DInovke implementation LSA plugin DLL written in C++ which could be clean up after dumping LSASS. MirrorDump compile LSA plugin as .NET assembly which would not be unloaded by LSASS process. That's why MirrorDump...

CVE-2024-33901-ProofOfConcept

CVE-2024-33901-ProofOfConcept Short program that demonstrates the vulnerability CVE-2024-33901 in KeePassXC version 2.7.7 The report for the class might need the source code linked, so that's why I created the repo for this How to replicate the vulnerability 1. Open KeePassXC and authenticate the...

IRTriage

Incident Response Triage: Scripted collection of system information valuable to a Forensic Analyst. IRTriage will automatically "Run As ADMINISTRATOR" in all Windows versions except WinXP. The original source was Triage-ir v0.851 an Autoit script written by Michael Ahrendt. Unfortunately Michael'...

CVE-2023-30367-mRemoteNG-password-dumper

mRemoteNG = v1.77.3.1784-NB Password Dumper CVE-2023-30367 Multi-Remote Next Generation Connection Manager mRemoteNG is free software that enables users to store and manage multi-protocol connection configurations to remotely connect to systems. mRemoteNG configuration files can be stored in an...

KeePass-CVE-2023-32784-Exploitation-and-Defense

KeePass Memory Leak Vulnerability CVE-2023-32784:Exploitation & Defense Architecture Objective To analyse the CVE-2023-32784 vulnerability in KeePass Password Safe v2.53, demonstrate master password extraction via memory dumping, and engineer robust detection and mitigation controls. The...

Netgrave

Netgrave A tool for retrieving login credentials from Netwave IP cameras using a memory dump vulnerability CVE-2018-17240. This project was inspired by expcamera and offers performance and efficiency improvements. This tool works for all platforms as it does not use any Linux CLI tools through...

BSOD_bitlocker_recover

BitLocker VMK Carving Tool This Python script helps you extract potential BitLocker Volume Master Keys VMKs from memory dump files, such as those generated by a Blue Screen of Death BSOD. It's a command-line utility designed to assist in forensic investigations where BitLocker encryption is...

LsassReflectDumping

LsassReflectDumping This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone is created, it utilizes MINIDUMPCALLBACKINFORMATION callbacks to generate a memory dump of the cloned process. Steps Getting the handle of...

keepass-password-dumper

KeePass 2.X Master Password Dumper CVE-2023-32784 Update The vulnerability was assigned CVE-2023-32784 and fixed in KeePass 2.54. Thanks again to Dominik Reichl for his fast response and creative fix! Clarification: the password has to be typed on a keyboard, not copied from a clipboard see the H...

keepass_dump

Keepass-Dumper This is my PoC implementation for CVE-2023-32784 My version is a python port of @vdohney's PoC along with a few changes and additional features. Changes One change, was to use known strings that can be found within the dump file in order to more accurately jump to the location of t...

radare2-scripts

radare2 Scripts Summary A 'collection' of scripts to be used with radare2. r2bincarver.py - A script used to carve files from memory dumps. r2hashfuncdecoder.py - A script used to decode hashed functions, commonly found in shellcode. Scripts Binary Carver This script will carve files from memory...

CVE-2023-32784-keepass-linux

KeePass 2.53/cmdline files and store the pid of ones with the keyword KeePass in their commandline argument. It'll then acquire the adresses of memory maps in /proc//maps that aren't directly associated with a library, meaning they have an empty file path. It'll then store the memory of all those...

KeePwn

A python script to help red teamers discover KeePass instances and extract secrets. Features KeePass Discovery Look for KeePass installation files through SMB C$ share. Accept multiple target sources IP, CIDR, hostname, file. Check for KeePass metadata version, last access time. Check for running...

PPLBlade

PPLBlade Protected Process Dumper Tool that support obfuscating memory dump and transferring it on remote workstations without dropping it onto the disk. Key functionalities : 1. Bypassing PPL protection 2. Obfuscating memory dump files to evade Defender signature-based detection mechanisms 3...

gentlemen-decryptor

The Gentlemen Ransomware Decryptor The first publicly available decryption method for The Gentlemen ransomware. The Gentlemen also known as hastalamuerte is currently the most active ransomware-as-a-service RaaS operation globally, with 320+ confirmed victims as of Q1 2026. Until now, every major...

cve-2023-32784

CVE-2023-32784 KeePass 2.X version 2.54 is susceptible to a vulnerability in which the master password may be retrievable from a memory dump of an unlocked KeePass database. This was assigned CVE-2023-32784 This program aims to retrieve the master password from a memory dump of a running KeePass...

linux_screenshot_xwindows

Intro The goal of this volatility plugin is to extract a screenshot of all open X windows from a memory dump. Previous work The volatility plugin linuxxwindows realised by Adam Bridge https://github.com/bridgeythegeek/linuxxwindows extracts various metadata from the window objects registered to X...

blindsight

blindsight "There's no such things as survival of the fittest. Survival of the most adequate, maybe. It doesn't matter whether a solution's optimal. All that matters is whether it beats the alternative." -- Peter Watts, Blindsight 2006 Red teaming tool to dump LSASS memory, bypassing basic...