ItWasAllADream

Todo fue un sueño Un escáner de Python para CVE-2021-34527 también conocido como PrintNightmare. Permite escanear subredes enteras en busca de la RCE de PrintNightmare no la LPE y genera un informe CSV con los resultados. Prueba la explotabilidad a través de MS-PAR y MS-RPRN. Esta herramienta tie...

NimExec

NimExec Básicamente, NimExec es una herramienta de ejecución remota de comandos sin archivos que utiliza el Protocolo Remoto del Administrador de Control de Servicios MS-SCMR. Cambia la ruta binaria de un servicio aleatorio o dado ejecutado por LocalSystem para ejecutar el comando dado en el...

CVE-2021-34527

PrintNightmare CVE-2021-34527 This version of the PrintNightmare exploit is based on the code created by Cube0x0, with the following features: Ability to target multiple hosts. Built-in SMB server for payload delivery, removing the need for open file shares. Exploit includes both MS-RPRN & MS-PAR...

EventLogin-CVE-2025-29969

EventLogin - CVE-2025-29969 EventLogin es una vulnerabilidad de tiempo de verificación a tiempo de uso en el protocolo MS-EVEN. La vulnerabilidad permite a usuarios con bajos privilegios escribir archivos arbitrarios en una máquina remota, evitando efectivamente la necesidad de una cuenta de...

CVE-2025-24071

Security Vulnerability Report: CVE-2025-24071 - Windows File Explorer Spoofing Vulnerability Overview NSFOCUS CERT has detected that Microsoft recently released a security update to address a critical spoofing vulnerability in Windows File Explorer, identified as CVE-2025-24071. This vulnerabilit...

CVE-2025-24054_CVE-2025-24071-PoC

CVE-2025-24054 and CVE-2025-24071 - NTLM Hash Leak via .library-ms Exploit This PoC demonstrates the exploitation of the NTLM hash leak via .library-ms files on unpatched Windows systems March 2025 Patch Tuesday. ⚠️ This is for educational and research purposes only. Do not use this on production...

teams-cookies-bof

teams-cookies-bof Steal cookies for Teams, while running within the ms-teams.exe process. Related post: https://tierzerosecurity.co.nz/2025/11/03/teams-cookies-bof.html Based on: https://blog.randorisec.fr/ms-teams-access-tokens/. This tool is heavily based on the Cookie-Monster-BOF. The BOF will...

CVE-2023-36884-MS-Office-HTML-RCE

CVE-2023-36884: MS Office HTML RCE with crafted documents On July 11, 2023, Microsoft released a patch aimed at addressing multiple actively exploited Remote Code Execution RCE vulnerabilities. This action also shed light on a phishing campaign orchestrated by a threat actor known as Storm-0978,...

SharpLAPS

SharpLAPS El atributo ms-mcs-AdmPwd almacena la contraseña LAPS en texto claro. Este ejecutable está diseñado para ejecutarse dentro de una sesión de Cobalt Strike usando execute-assembly. Recuperará la contraseña LAPS del Active Directory. Requiere cualquiera de: Cuenta con ExtendedRight o Gener...

Windows-Explorer-CVE-2025-24071

Windows-Explorer-CVE-2025-24071 Informe de Vulnerabilidad de Seguridad: CVE-2025-24071 - Vulnerabilidad de Suplantación del Explorador de Archivos de Windows Resumen NSFOCUS CERT ha detectado que Microsoft lanzó recientemente una actualización de seguridad para solucionar una vulnerabilidad críti...

msdt-follina

msdt-follina Microsoft MS-MSDT Follina 0-day Vulnerability CVE-2022-30190 Attack Vector...

UnBattletech

UnBattletech Reverse engineering of BattleTech: The Crescent Hawk's Inception 1988, MS-DOS; published by Infocom, engine by Westwood Associates — and an in-progress Godot 4 / C recreation of it. Read this section before trusting anything else in this repo. The project is two efforts with very...

lifer

lifer Una herramienta forense para el examen de archivos de enlace de Windows es decir, accesos directos de Windows SINOPSIS 'lifer' es una herramienta de línea de comandos para Windows o nix inspirada en el documento técnico 'The Meaning of Link Files in Forensic Examinations' de Harry Parsonage...

CVE-2020-1472

CVE-2020-1472 Netlogon Remote Protocol Call MS-NRPC Privilege Escalation Zerologon The attack described here takes advantage of flaws in a cryptographic authentication protocol insecure use of AES-CFB8 that proves the authenticity and identity of a domain-joined computer to the Domain Controller...

FOLLINA-CVE-2022-30190

FOLLINA-CVE-2022-30190 Implementation of FOLLINA-CVE-2022-30190 This repository contains an exploitation tool for the vulnerability FOLLINA-CVE-2022-30190 Disclaimer This tool developed for security testing and research purposes. by cloning / forking this tool the origin developer withdraw any...

PicusSecurity4.Week.Repo

githubRepo for follina vuln CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina...

CVE-2025-24071

Security Vulnerability Report: CVE-2025-24071 - Windows File Explorer Spoofing Vulnerability Overview NSFOCUS CERT has detected that Microsoft recently released a security update to address a critical spoofing vulnerability in Windows File Explorer, identified as CVE-2025-24071. This vulnerabilit...

PrintNightmare

PrintNightmare Python implementation for PrintNightmare CVE-2021-1675 / CVE-2021-34527 using standard Impacket. Installtion $ pip3 install impacket Usage Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation usage: printnightmare.py -h -debug -port destination port -target-ip ip address -hashe...

refinery

Binary Refinery docs tests codecov pypi High Octane Triage Analysis || || || || || | / / / \ || ==||=====|| | / |/ \ /==| / \ ===| '======|| | \ | | \ | \ /| | || || /||/ / | | | || =========''====/=========/ /==||=====||======' \ / / The Binary Refinery™ is a collection of Python scripts...

gollina

$ gollina -h gollina Follina MS-MSDT 0-day MS Office RCE PoC in Go -- @dwisiswant0 Usage: gollina -c COMMAND OPTIONS... Options: -h, --host Listener host default: 0.0.0.0 -p, --port Listener port default: 8090 -n, --name Word file name w/o extension, default: gollina -c, --command Arbitrary comma...