CVE-2025-24071_PoC

CVE-2025-24071PoC CVE-2025-24071: NTLM Hash Leak via RAR/ZIP Extraction and .library-ms File Windows Explorer automatically initiates an SMB authentication request when a .library-ms file is extracted from a .rar archive, leading to NTLM hash disclosure. The user does not need to open or execute...

CVE-2017-11882-

CVE-2017-11882 43b original script from https://github.com/embedi/CVE-2017-11882 109b original script from https://github.com/unamer/CVE-2017-11882/ Kudos, now unamer's code can execute shellcode CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ MITRE...

SharpLAPS

SharpLAPS The attribute ms-mcs-AdmPwd stores the clear-text LAPS password. This executable is made to be executed within Cobalt Strike session using execute-assembly. It will retrieve the LAPS password from the Active Directory. Require either: Account with ExtendedRight or Generic All Rights...

CVE-2022-30190_Temporary_Fix

🩹CVE-2022-30190 Temporary Fix🩹 These are two Python scripts compiled to easily and quickly apply temporary protection against the CVE-2022-30190 vulnerability Follina Both can be programmed better, but this is just to implement it as quickly as possible and I did it without much Python knowledge,...

CVE-2025-24071_POC

Video Tutorial Windows Library File Creator CVE-2025-24071/CVE-2025-24054 Demo A minimalistic Rust application that demonstrates the creation of Windows Library files .library-ms with configurable network paths. Overview This project creates Windows Library Description .library-ms files that poin...

CVE-2020-1472

CVE-2020-1472 Netlogon Remote Protocol Call MS-NRPC Privilege Escalation Zerologon The attack described here takes advantage of flaws in a cryptographic authentication protocol insecure use of AES-CFB8 that proves the authenticity and identity of a domain-joined computer to the Domain Controller...

CVE-2025-24071_PoCExtra

CVE-2025-24071PoCExtra Alternative CVE-2025-24071PoC Original Code https://github.com/0x6rss/CVE-2025-24071PoC When testing with another similar extension, I tried ".searchconnector-ms" using the same structure, but the issue with the first PoC also affected it. python poc2.py Enter the IP addres...

CVE-2017-11882

CVE-2017-11882 43b Original script from https://github.com/embedi/CVE-2017-11882 109b Original script from https://github.com/unamer/CVE-2017-11882/ Kudos, unamer's code can now execute shellcode CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ MITRE...

PicusSecurity4.Week.Repo

githubRepo for follina vuln CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina...

refinery

Binary Refinery docs tests codecov pypi High Octane Triage Analysis || || || || || | / / / \ || ==||=====|| | / |/ \ /==| / \ ===| '======|| | \ | | \ | \ /| | || || /||/ / | | | || =========''====/=========/ /==||=====||======' \ / / The Binary Refinery™ is a collection of Python scripts...

msdt-follina

MS-MSDT "Follina" Attack Vector John Hammond | May 30, 2022 Create a "Follina" MS-MSDT attack with a malicious Microsoft Word document and stage a payload with an HTTP server. Usage usage: follina.py -h --command COMMAND --output OUTPUT --interface INTERFACE --port PORT options: -h, --help show...

CVE-2017-11882

CVE-2017-11882 43b original script from https://github.com/embedi/CVE-2017-11882 109b original script from https://github.com/unamer/CVE-2017-11882/ Kudos, now unamer's code can execute shellcode CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ MITRE...

armadito-windows-driver

Armadito Windows Driver Armadito Windows Driver is responsible of on-access protection of Armadito antivirus. Copyright C Teclib', 2015, 2016 Project home : http://www.teclib-edition.com/teclib-products/armadito-antivirus See Online documentation at : http://armadito-av.readthedocs.io/en/latest/...

CVE-2022-30190

MS-MSDT Follina CVE-2022-30190 PoC Malicious docx generator to exploit Microsoft Office Word Remote Code Execution Creation of this Script is based on CVE-2021-40444 PoC by LockedByte and writeup by Tothi Using First modify backup.html and replace powershell payload. Right now just pops a calc.ex...

CVE-2018-0802_CVE-2017-11882

RTF118820802 CVE-2017-11882 CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882 MITRE CVE-2017-11882: https://vulners.com/cve/CVE-2017-11882 Research: https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about Patch analysis:...

DNSRPC-BOF

DNSRPC-BOF Beacon Object File BOF implementation of the dnscmd.exe functionality used to obtain remote code execution on an ADIDNS server by exploiting the ServerLevelPluginDll edge1 2 3 by using MS-DNSP. 4 Exploitation requires access to a user account that is a member of the DnsAdmins group...

CVE-2025-50472

CVE-2025-50472 ModelScope Ms-Swift ModelFileSystemCache Deserialization of Untrusted Data Remote Code Execution Vulnerability RCE PoC I uploaded a code repository containing a malicious .mdl file to ModelScope for testing purposes. It can be used directly during testing. The link is:...

Cooolis-ms

Cooolis-ms Wiki Documentation Cooolis-ms is a code execution tool that includes a Metasploit Payload Loader, Cobalt Strike External C2 Loader, and Reflective DLL injection. It is designed to evade static detection of code we intend to execute that contains known signatures, helping red team...

DFSCoerce

DFSCoerce PoC for MS-DFSNM coerce authentication using NetrDfsRemoveStdRoot and NetrDfsAddStdRoot found by @xctde methods. Documentation: https://docs.microsoft.com/en-us/openspecs/windowsprotocols/ms-dfsnm/95a506a8-cae6-4c42-b19d-9c1ed1223979 Inspired by: PetitPotam @topotam77...

CVE-2017-11882

CVE-2017-11882 CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882 MITRE CVE-2017-11882: https://vulners.com/cve/CVE-2017-11882 Research: https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about Patch analysis:...