CVE-2018-8174-msf

CVE-2018-8174-msf This is a metasploit module which creates a malicious word document to exploit CVE-2018-8174 - VBScript memory corruption vulnerability. This module is a very quick port and uses the exploit sample that was found in the wild. The exploit works only for Microsoft Office 32-bit...

physmem2profit

Physmem2profit Physmem2profit can be used to create a minidump of a target host's LSASS process by analysing physical memory remotely. The intention of this research is to propose an alternative approach to credential theft and create a modular framework that can be extended to support other...

memOptix

memOptix Questo notebook Jupyter è stato creato per assistere i professionisti DFIR nel triage dei dump di memoria Windows. Si prega di notare che questo notebook è stato creato sulla base dell'output generato dallo script Python Supermem di CrowdStrike https://github.com/CrowdStrike/SuperMem. La...

CVE-2014-0196

CVE-2014-0196 The nttywrite function in drivers/tty/ntty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service memory corruption and system crash or gain privileges by triggering a race...

mongobleed

MongoDB Compression Leak Lab Safe, Educational Reference CVE : CVE-2025-14847 This repository is an educational lab that demonstrates the concept behind a class of issues often described as “compression framing / size-metadata memory disclosure” in database wire protocols. It is written to suppor...

Cronos

Cronos This project was co-authored by Description PoC for a new sleep obfuscation technique based on Ekko leveraging waitable timers to RC4 encrypt the current process and change the permissions from RW to RX to evade memory scanners. A more detailed explanation will be available in the blog pos...

AzTokenFinder

AzTokenFinder Is a small tool to extract JWT or JWT like looking data from different processes, like PowerShell, Excel, Word or others. The idea was inspired from the blog post https://mrd0x.com/stealing-tokens-from-office-applications/ from the amazing @mrd0x. In the new release, I added the...

NimShellcodeFluctuation

NimShellcodeFluctuation Nim Port of the original repo: https://github.com/mgeeky/ShellcodeFluctuation All comments were copy pasted as they were from the original Repository as they really helped me to understand the technique. For more information about the technique itself I highly recommend...

TickTock

TickTock This repository demonstrates a PoC memory scanner for enumerating timer-queue timers as used in Ekko Sleep Obfuscation: https://github.com/Cracked5pider/Ekko. For a full technical walkthrough please see the accompanying blog post here:...

truffleproc

truffleproc — hunt secrets in process memory Usage Run truffleproc.sh against your current Bash shell e.g. $$: $ ./truffleproc.sh $$ coredumping pid 6174 Reading symbols from od... Reading symbols from /usr/lib/systemd/systemd... Reading symbols from /lib/systemd/libsystemd-shared-247.so... Readi...

PsyloDbg

PsyloDbg PsyloDbg is a fast-growing and user-friendly open-source Windows Debugger entirely coded in Delphi. The main goal of this project is to offer to Malware analysts another tool to short their response time during their analysis process. The project is still in very early stage, it is...

MoreImpacketExamples

MoreImpacketExamples This repository contains a few short python scripts that were created using the Impacket library. The primary goal of this project is to help myself and others who are looking to transition from using the provided impacket examples to modifying/creating scripts of their own...

SuperMem

Overview A python script developed to process Windows memory images based on triage type. Requirements Python3 Bulk Extractor Volatility2 with Community Plugins Volatility3 Plaso Yara How to Use Quick Triage python3 winSuperMem.py -f memdump.mem -o output/ -tt 1 Full Triage python3 winSuperMem.py...

CVE-2022-4174_CVE-2022-41742

CVE-2022-4174CVE-2022-41742 PoC for CVE-2022-4174CVE-2022-41742 to determine if Nginx 1.22.1 is vulnerable [email protected] This PoC allows determining if an Nginx server version 1.22.1 is vulnerable to certain known vulnerabilities, including: CVE-2022-41741 : Memory corruption in the...

Lsass-Shtinkering

Lsass Shtinkering New method of dumping LSASS by abusing the Windows Error Reporting service. It sends a message to the service with the ALPC protocol to report an exception on LSASS. This report will cause the service to dump the memory of LSASS. Prerequisites The registry value "DumpType" under...

IntelTXE-PoC

Disclaimer All information is provided for educational purposes only. Follow these instructions at your own risk. Neither the authors nor their employer are responsible for any direct or consequential damage or loss arising from any person or organization acting or failing to act on the basis of...

de4dot

Description de4dot is an open source GPLv3 .NET deobfuscator and unpacker written in C. It will try its best to restore a packed and obfuscated assembly to almost the original assembly. Most of the obfuscation can be completely restored eg. string encryption, but symbol renaming is impossible to...

Damn_Vulnerable_C_Program

Note: file name has been changed from imgRead.c to dvcp.c, if you are watching videos, you will see imgRead.c but in github repo you will see dvcp.c, please use correct filename. Damn Vulnerable C ProgramDVCP My YouTube Channel: https://www.youtube.com/user/MrHardik05/featured?viewas=subscriber...

cve-2024-21978-poc

SEV Firmware Vulnerability This repo contains an exploit for a vulnerability in the SEV firmware. The exploit allows decrypting arbitrary memory of a running SEV-SNP guest. Tested on version 1.55.16 latest as of the time of writing. Root Cause The nvpaddr field of the SEVINITEX command can be use...

cve-2024-21980-poc

SEV Firmware Vulnerability This repo contains an exploit for a vulnerability in the SEV firmware. The exploit allows decrypting arbitrary memory of an SEV-SNP guest after it's been decommissioned. Tested on version 1.55.16 latest as of time of writing. Root Cause The SEV firmware has a table call...