Lucene search
+L

3836 matches found

Kitploit
Kitploit
added 2026/09/16 3:19 a.m.10 views

RawHive

RawHive RawHive is a Cobalt Strike BOF for pulling selected Windows registry hives directly from a raw NTFS volume. It skips the normal file APIs, walks NTFS metadata to find the target file records, and copies the bytes straight from disk. It currently looks for: C:\Windows\System32\config\SAM...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/16 2:23 a.m.15 views

plaso

Plaso Plaso Langar Að Safna Öllu - super timeline all the things Plaso Plaso Langar Að Safna Öllu, or super timeline all the things , is a Python-based engine used by several tools for automatic creation of timelines. Plaso default behavior is to create super timelines but it also supports creati...

5.7AI score
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/16 2:06 a.m.14 views

CVE-2021-31956-POC

" CVE-2021-31956" WIP PoC code for CVE-2021-31956 in preparation for OSEE. Will improve it further after my OSEE exams and free time. A lot of hardcoded offsets need to be changed if it is different on the target system but if it is anything similar to 2020 - 2021 builds then no change should be...

9.3CVSS7AI score0.81107EPSS
SaveExploits5References2
Kitploit
Kitploit
added 2026/09/16 1:12 a.m.9 views

blindsight

blindsight "There's no such things as survival of the fittest. Survival of the most adequate, maybe. It doesn't matter whether a solution's optimal. All that matters is whether it beats the alternative." -- Peter Watts, Blindsight 2006 Red teaming tool to dump LSASS memory, bypassing basic...

5.9AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/16 12:27 a.m.14 views

libfsntfs

libfsntfs is a library to access the New Technology File System NTFS format. Project information: Status: experimental Licence: LGPL-3.0-or-later Read-only supported NTFS formats: NTFS version 3.0 NTFS version 3.1 Supported NTFS format features: LZNT1 compression Windows Overlay Filter WOF...

5.7AI score
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/15 11:43 p.m.8 views

CVE-2026-41091-PoC-Exploit

☀️ CVE-2026-41091 - RedSun SolarFlare - Microsoft Defender LPE Exploit Microsoft Defender Link Following Vulnerability - Local Privilege Escalation to NT AUTHORITY\SYSTEM The vulnerability is known as "RedSun" 🎯, "SolarFlare" is the name I gave to my exploit. ✅ 📌 Overview This repository contains...

7.8CVSS8.1AI score0.08202EPSS
SaveExploits3References3
Kitploit
Kitploit
added 2026/09/15 11:31 p.m.19 views

RecuperaBit

RecuperaBit Un software que intenta reconstruir estructuras de sistemas de archivos y recuperar archivos. Actualmente solo soporta NTFS. RecuperaBit intenta la reconstrucción de la estructura de directorios independientemente de: tabla de particiones faltante límites de partición desconocidos...

6AI score
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/15 11:23 p.m.9 views

CVE-2026-36213

CVE-2026-36213 CVE-2026-36213 | Local Privilege Escalation in MEmu Android Emulator 9.2.7.0 via Insecure Service Binary Permissions | Patched in 9.3.2 CVE-2026-36213 — MEmu Android Emulator 9.2.7.0 LPE Summary A Local Privilege Escalation LPE vulnerability in MEmu Android Emulator 9.2.7.0. The...

7.8CVSS6AI score0.00585EPSS
SaveExploits2References1
Kitploit
Kitploit
added 2026/09/15 11:15 p.m.11 views

CVE-2021-28312

CVE-2021-28312 POC and description for CVE-2021-28312 Windows NTFS Denial of Service Vulnerability Link: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-28312 Reproduction From cmd: type following command cd c::$i30:$bitmap Remote exploitation possibility: Can be done by...

6.5CVSS6.4AI score0.06599EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/15 9:07 p.m.8 views

DriverJack

DriverJack Introduction DriverJack is a tool designed to load a vulnerable driver by abusing lesser-known NTFS techniques. These method bypass the registration of a Driver Service on the system by hijacking an existing service, and also spoof the image path presented in the Driver Load event. To...

5.9AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/15 8:41 p.m.3 views

ExtractUsnJrnl

El diario de cambios en NTFS es un archivo ubicado en $Extend$UsnJrnl. Es un metarchivo del sistema que no es posible encontrar en un listado de directorio normal, ni siquiera por medios habituales. Los datos relevantes se encuentran en el flujo de datos alternativo llamado $J. También hay otro A...

5.7AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/15 8:26 p.m.13 views

irflow-timeline

IRFlow Timeline Native macOS forensic timeline analysis. Import, search, and investigate EVTX, CSV, XLSX, Plaso, $MFT, $J, and local AI assistant artifacts — with AI Secret Hunt and the analytics DFIR professionals actually need. Built on Electron + SQLite to handle millions of rows without...

6AI score
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/15 7:54 p.m.13 views

LogFileParser

Features Decode and dump $LogFile records and transaction entries. Decode NTFS attribute changes. Optionally resolve all datarun list information available in $LogFile. Option: "Reconstruct data runs". Recover transactions from slack space within $LogFile. Choose to reconstruct missing or damaged...

5.6AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/15 7:49 p.m.10 views

CVE-2026-0827

CVE-2026-0827 The LdeApi.Server.exe process attempts to write MP27AM7Westimation.json to C:\ProgramData\Lenovo\LDE\SYSTEM without impersonation. This directory does not exist by default. Since C:\ProgramData\ allows standard users to create subdirectories, a low-privileged user can create this pa...

7.1CVSS5.9AI score0.00212EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/15 7:48 p.m.10 views

UnderlayCopy

UnderlayCopy UnderlayCopy is a PowerShell utility for low-level NTFS acquisition and dumping protected, locked system artifacts for example: SAM , SYSTEM , NTDS.dit , registry hives , and other files that are normally inaccessible while Windows is running. It supports two complementary modes to...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/15 7:23 p.m.191 views

tscopy

TScopy Updated 2022-03-31 Introducing TScopy It is a requirement during an Incident Response IR engagement to have the ability to analyze files on the filesystem. Sometimes these files are locked by the operating system OS because they are in use, which is particularly frustrating with event logs...

6.3AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/15 7:23 p.m.13 views

tscopy

TScopy Actualizado 2022-03-31 Presentando TScopy Durante un compromiso de Respuesta a Incidentes IR, es necesario tener la capacidad de analizar archivos en el sistema de archivos. A veces, estos archivos están bloqueados por el sistema operativo SO porque están en uso, lo que es particularmente...

6AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/15 6:24 p.m.9 views

CVE-2023-36424

信息 ============== Windows 内核池(clfs.sys)损坏权限提升。(CVE-2023-36424) 本仓库包含技术分析与有效利用代码。 作者:Nassim Asrir @p1k4l4 || https://www.linkedin.com/in/nassim-asrir-b73a57122/ 漏洞 ================ clfs.sys 微过滤器驱动程序中存在池溢出。相关信息可参阅: 1 -...

7.8CVSS8.1AI score0.12184EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/15 4:55 p.m.7 views

CVE-2024-44193

Hacking Windows through iTunes - Local Privilege Escalation 0-day Introducing CVE-2024–44193 This is a write up on CVE-2024–44193 which is a Local Privilege Escalation exploit in iTunes version 12.13.2.3. It was patched September 12, 2024 by Apple. Link to Apple's Security Advisory: Apple's...

8.4CVSS6.4AI score0.00404EPSS
SaveExploits1References2
Kitploit
Kitploit
added 2026/09/15 4:22 p.m.70 views

ntfstool

ntfstool NTFSTool is a forensic tool focused on NTFS volumes. It supports reading partition info MBR, partition table, VBR but also information on Master File Table, Bitlocker encrypted volume, EFS encrypted files, USN journal and more. Download the latest binaries on AppVeyor or by checking the...

5.7AI score
SaveExploits0References8
Rows per page
Query Builder