CVE-2026-9490

CVE ID: CVE-2026-9490 Researcher: Vo Duc Thang ugvxb Acknowledgement: https://community.acer.com/en/kb/articles/19668 1. Executive Summary A critical security vulnerability has been identified in the Acer Care Center service ACCSvc.exe. The vulnerability allows any authenticated local user to...

CVE-2020-11493

CVE-2020-11492 Proof-of-Concept PoC for Docker Desktop for Windows privilege escalation vulnerability. This vulnerability was patched in Docker version 2.3.0.2 on May 11th, 2020. This PoC performs the following: creates a named pipe mimicking docker named pipe \.\pipe\dockerLifecycleServer, call...

CVE-2026-94300

CVE-2026-94300 — PoC: Leak docker logs → Model-RCE Note: This analysis and PoC were produced substantially with AI assistance "AI patchwork". Every code, diff and measurement claim should be verified against the cited sources before being relied upon. Self-contained PoC folder for the exploitatio...

InjectSetConsole

InjectSetConsole InjectSetConsole performs process code injection by leveraging a Windows named pipe. Unlike traditional techniques, it does not use the VirtualAllocEx and WriteProcessMemory APIs. Command Line Syntax InjectSetConsole.exe executablepath : netsh.exe, nslookup.exe,... or other...

DFShell

██████╗ ███████╗███████╗██╗ ██╗███████╗██╗ ██╗ ██╔══██╗██╔════╝██╔════╝██║ ██║██╔════╝██║ ██║ ██║ ██║█████╗ ███████╗███████║█████╗ ██║ ██║ ██║ ██║██╔══╝ ╚════██║██╔══██║██╔══╝ ██║ ██║ ██████╔╝██║ ███████║██║ ██║███████╗███████╗███████╗ ╚═════╝ ╚═╝ ╚══════╝╚═╝ ╚═╝╚══════╝╚══════╝╚══════╝...

CVE-2026-9789

CVE ID: CVE-2026-9789 Researcher: Vo Duc Thang ugvxb Acknowledgement: https://community.acer.com/en/kb/articles/19670 Video POC: https://drive.google.com/file/d/1B8b42bE68CWMnlqG6eJWi0txGFsHAJZc/view?usp=sharing 1. Executive Summary A critical local privilege escalation vulnerability has been...

CVE-2026-42945

NGINX CVE-2026-42945 Rift — local defensive lab Two Dockerized NGINX instances: pattern-based “risky rewrite” snippet vs remediated named-capture snippet, pinned to nginx:1.30.0-alpine / nginx:1.30.1-alpine. Scripts run benign curls, dump nginx -T, and archive evidence. For configuration review...

CVE-2020-0787

CVE-2020-0787（named pipe） It's Just A Demo,Do not use in real. -Get result for Command executionUse cmd /c： exp.exe "cmd /c whoami \\.\pipe\showme " show -Run beacon.exe： exp.exe "C:/beacon.exe" For CobaltStrike It's better one than current project:...

Aladdin

Aladdin .-. .-''-., | //\ ";\ "/ \ , |'./ \ '='-, /\ \ || ///\ '. T |\ | /,-' '. '..-' /'/ | | '. .'-../ ,\ / '-' |/ /-----j .--..--'\ / --' '---. / '---. -'. .' .-- '. \ '--. ;.-o / '. /.8----' c-'----' Lefty @lefterispan - Nettitude Red Team - 2022 / 2023 About Aladdin is a payload generation...

pipe-intercept

pipe-intercept Intercept Windows Named Pipes communication using Burp or similar HTTP proxy tools Named Pipes are very popular for interprocess communication on Windows. They are used in many applications, including Windows Remote Procedure Call RPC. The purpose of this tool is to allow security...

Windows-Kernel-Exploitation

1. Non-Paged Pool Overflow Exploitation with Named Pipes Techniques based on named pipes for pool overflow exploitation demonstrated on CVE-2020-17087 and an off-by-one overflow 2. Segment Heap VS Allocator Metadata Abuse Techniques for turning a potentially limited write primitive eg a pool...

RPC-Backdoor

RPC Backdoor Emulation This project is a basic implementation of an "RPC Backdoor" meant to emulate TTPs used by certain groups. The project contains an RPC server with five functions: Execute a command with cmd.exe /c and the CreateProcess API call. Steal a token and execute a command with cmd.e...

serviceDetector

serviceDetector Detect whether a service is installed blindly and/or running if exposing named pipes on a remote machine without using local admin privileges. About In more detail, running this script connects to the target SMB service 445/tcp remotely and does the following: 1. Checks if the...

inject-assembly

inject-assembly - Execute .NET in an Existing Process This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon,...

thats_no_pipe

Thats no pipe Frida-based project to intercept Windows named pipe communication Objectives This project aims at intercepting IPC communications by hooking specific WinAPI functions and forwarding them to an HTTP proxy using a websocket. Architecture Read from and write to a named pipe can happen ...

psexec_noinstall

psexecnoinstall The repository contains psexec, which will help to exploit the forgotten pipe Have a non-genius administrator connect using PsExec to the host: We discovered this when we saw the RemComCommunication bundle. This one is standard for PsExec Using psexecnoinstall, it is possible to...

SharpNamedPipePTH

SharpNamedPipePTH This project is a C tool to use Pass-the-Hash for authentication on a local Named Pipe for user Impersonation. You need a local administrator or SEImpersonate rights to use this. There is a blog post for explanation: https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/ It is heavily...

FortiLPE

Description Local privilege escalation PoC exploit for CVE-2025-62676 / EUVD-2025-206993 that targets FortiClient VPN running on Windows. Executes a payload in the context of SYSTEM from a normal user context via an arbitrary XML file write. The PoC has been tested against FortiClient version 7.4...

PetitPotato

PetitPotato Local privilege escalation via PetitPotam Abusing impersonate privileges. Description PetitPotam uses MS-EFSR Encrypting File System Remote, a protocol used to perform maintenance and management operations on encrypted data stored remotely and accessed over a network. There are a seri...

NamedPipePTH

NamedPipePTH This project is a PoC code to use Pass-the-Hash for authentication on a local Named Pipe user Impersonation. There also is a blog post for explanation: https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/ It is heavily based on the code from the projects Invoke-SMBExec.ps1 and RoguePotat...