CVE-2022-24924

Improper access control vulnerability in LiveWallpaperService CVE-2022-24924SVE-2021-24089 Windows version tested: Windows 10 20H2 Build 19042.1348 64bit Live Wallpaper Version: 3.0.9.0 or earlier There is a LiveWallpaperService that works by default in Samsung laptops, but there was a...

NamedPipePTH

NamedPipePTH Este proyecto es un código PoC para usar Pass-the-Hash para autenticación en una tubería con nombre local mediante suplantación de usuario. También hay una entrada de blog con explicación: https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/ Se basa en gran medida en el código de los...

CVE-2024-40586-Windows-Coerced-Authentication-in-FortiClient

CVE-2024-40586 Windows Coerced Authentication in FortiClient On Windows system, it was found that FortiClient App version 7.0.8.0427 allow a remote unprivileged user to coerce Windows hosts authenticate to other machines via a named pipe responsible for FortiSSLVPNdaemon service. It was observed...

thats_no_pipe

Thats no pipe Frida-based project to intercept Windows named pipe communication Objectives This project aims at intercepting IPC communications by hooking specific WinAPI functions and forwarding them to an HTTP proxy using a websocket. Architecture Read from and write to a named pipe can happen ...

SharpNamedPipePTH

SharpNamedPipePTH Este proyecto es una herramienta en C para usar Pass-the-Hash en la autenticación de una tubería con nombre local para la suplantación de usuario. Necesitas ser administrador local o tener derechos SEImpersonate para usarlo. Hay una publicación en el blog con la explicación:...

MultiPotato

MultiPotato En primer lugar - créditos a @splintercode y @decoderit por RoguePotato ya que este código se basa en gran medida en él. Esta es solo otra Potato para obtener SYSTEM mediante privilegios SeImpersonate. Pero esta se diferencia en cuanto a No contiene ningún desencadenante de...

eternal_scanner

ETERNAL SCANNER 2.4 Eternal scanner es un escáner de red para el exploit Eternal Blue CVE-2017-0144 y Eternal Romance tubería con nombre CVE-2017-0145 . Capturas de pantalla Versión 2.2 Nuevas implementaciones Verificación de vulnerabilidad Eternal Romance escan -er Resultados divididos de la bas...

Aladdin

Aladdin root@kitploit: .-. .-''-., | //\ ";\ "/ \ , |'./ \ '='-, /\ \ || ///\ '. T |\ | /,-' '. '..-' /'/ | | '. .'-../ ,\ / '-' |/ /-----j .--..--'\ / --' '---. / '---. -'. .' .-- '. \ '--. ;.-o / '. /.8----' c-'----' Lefty @lefterispan - Nettitude Red Team - 2022 / 2023 Acerca de Aladdin es...

PetitPotam

PetitPotam Herramienta PoC para forzar a hosts Windows a autenticarse en otras máquinas a través de MS-EFSRPC EfsRpcOpenFileRaw u otras funciones : Las herramientas utilizan la tubería con nombre LSARPC con la interfaz c681d488-d850-11d0-8c52-00c04fd90f7e porque es más prevalente. Pero es posible...

CVE-2024-0311

CVE-2024-0311 ? This is a PoC for what I believe is CVE-2024-0311, SB10418. A malicious insider can bypass the existing policy of Skyhigh Client Proxy without a valid release code. Much details. Very exploit. ¯\ツ /¯ The PoC injects into a user-ran SCPBypass.exe process and writes to the...

inject-assembly

inject-assembly - Ejecutar .NET en un Proceso Existente Esta herramienta es una alternativa a la ejecución tradicional fork and run para Cobalt Strike. El cargador puede ser inyectado en cualquier proceso, incluido el Beacon actual. Los ensamblados de larga duración continuarán ejecutándose y...

inject-assembly

inject-assembly - Execute .NET in an Existing Process This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon,...

LiquidSnake

Liquid Snake Liquid Snake es un programa diseñado para realizar movimiento lateral contra sistemas Windows sin tocar el disco. La herramienta se basa en la Suscripción a Eventos WMI para ejecutar un ensamblado .NET en memoria; el ensamblado .NET escuchará un shellcode en una tubería con nombre y...

exploit-CVE-2017-7494

SambaCry RCE exploit for Samba 4.5.9 Samba is a free software re-implementation of the SMB/CIFS networking protocol. Samba provides file and print services for various Microsoft Windows clients and can integrate with a Microsoft Windows Server domain, either as a Domain Controller DC or as a doma...

CrystalPotato

CrystalPotato Crystal port of GodPotato, a local privilege escalation from accounts with SeImpersonatePrivilege to SYSTEM. It works by abusing the DCOM OXID Resolver and named pipe impersonation. Windows APIs are resolved dynamically and invoked through indirect syscall stubs, all strings are...

CVE-2020-0787

CVE-2020-0787（named pipe） It's Just A Demo,Do not use in real. -Get result for Command executionUse cmd /c： exp.exe "cmd /c whoami \\.\pipe\showme " show -Run beacon.exe： exp.exe "C:/beacon.exe" For CobaltStrike It's better one than current project:...

CVE-2020-11493

CVE-2020-11492 Proof-of-Concept PoC for Docker Desktop for Windows privilege escalation vulnerability. This vulnerability was patched in Docker version 2.3.0.2 on May 11th, 2020. This PoC performs the following: creates a named pipe mimicking docker named pipe \.\pipe\dockerLifecycleServer, call...

CVE-2025-70342

CVE-2025-70342: Credential Interception via Named Pipe in erase-install Summary erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.json. On Apple Silicon Macs, admin credentials entered during reinstall/erase operations are written...

exploit-CVE-2017-7494

SambaCry RCE exploit for Samba 4.5.9 Samba is a free software re-implementation of the SMB/CIFS networking protocol. Samba provides file and print services for various Microsoft Windows clients and can integrate with a Microsoft Windows Server domain, either as a Domain Controller DC or as a doma...

RPC-Backdoor

RPC Backdoor Emulation This project is a basic implementation of an "RPC Backdoor" meant to emulate TTPs used by certain groups. The project contains an RPC server with five functions: Execute a command with cmd.exe /c and the CreateProcess API call. Steal a token and execute a command with cmd.e...