CVE-2026-50416-writeup-and-poc

CVE-2026-50416: One QWORD Too Many in the Desktop Heap On Windows 11 Insider build 10.0.28020.2149, the user mode mapping of the Win32k desktop heap exposed a raw kernel session pool pointer at offset 0x100. The read itself is almost offensively small: ULONG64 leaked = ULONG64 desktopheap + 0x100...

CVE-2016-3309_Reloaded

Kernel Exploitation Case Study - "Wild" Pool Overflow on Win10 x64 RS2 CVE-2016-3309 Reloaded This Github repo contains exploits for the recently-patched win32kfull!bFill vulnerability. Executing the Palette or Bitmap exploit will give you SYSTEM privileges on the affected system. The exploits...

asus-bsitf-0-day-poc

POC - ASUS bsitf.sys Kernel Memory Mapping to Usermode CVE-2026-13585 Summary The ASUS bsitf.sys also distributed as AsusBSItf.sys kernel driver exposes IOCTL 0x222808 which allocates physically contiguous kernel memory of attacker-controlled size, maps it into the calling process's address space...

DHCPig

DHCPig Whitehat DHCP hardening validation: exhaust a pool, hijack neighbours' leases, evict hosts off their addresses with forged ARP, and report whether the network stopped you. Needs root and Python 3.11+. Run the web UI Debian / Kali: grab the latest .deb from Releases and install it — puts...

RedTeamCoin

RedTeamCoin RedTeamCoin is a blockchain-based cryptocurrency mining pool implementation designed for authorized security testing and red team operations. Built in Go with Java client support, it simulates real-world cryptomining attacks to help organizations assess their detection capabilities an...

hulk

Hulk DoS tool HULK DoS tool ported to Go language from Python. Original Python utility by Barry Shteiman http://www.sectorix.com/2012/05/17/hulk-web-server-dos-tool/ I just ported the code as is quick and dirty. Original functions names are keeped and original logic mostly keeped too. The main...

CVE-2023-36899

CVE-2023-36899 Reproduction environment and tooling for CVE-2023-36899, a cookieless session authentication bypass in the ASP.NET framework. Cookieless DuoDrop: IIS Auth Bypass & App Pool Privesc in ASP.NET Framework CVE-2023-36899 In modern web development, despite cookies being the preferred...

CVE-2023-36424

Information ============== Windows Kernel Pool clfs.sys Corruption Privilege Escalation. CVE-2023-36424 This repo contains technical analysis & working exploit. Author: Nassim Asrir @p1k4l4 || https://www.linkedin.com/in/nassim-asrir-b73a57122/ Vulnerability ================ There is a pool...

blutter

Blutter Flutter Mobile Application Reverse Engineering Tool by Compiling Dart AOT Runtime Currently the application supports only Android libapp.so arm64 only. Also the application is currently work only against recent Dart versions. For high priority missing features, see TODO Environment Setup...

px-vm

PerimeterX Auditor VM Analysis Summary This repository documents the reverse engineering of PerimeterX's auditor.js, a bytecode virtual machine used as a secondary fingerprinting layer in PX's bot detection pipeline. This analysis covers: Bytecode extraction and 5-layer decryption pipeline Opcode...

faxhell

faxhell "Fax Shell" A Proof-of-Concept bind shell using the Fax service and a DLL hijack based on Ualapi.dll. See our writeup at: https://windows-internals.com/faxing-your-way-to-system/ How to use Build Ualapi.dll and place in c:\windows\system32 Start the Fax service, which will load the DLL an...

Exploit-CVE-2017-6008

Exploit-CVE-2017-6008 The CVE-2017-6008 is a vulnerability in the HitmanPro scan that allows privilege escalation by exploiting a kernel pool buffer overflow. The exploits here use the Quota Process Pointer Overwrite attack as described in the Tarjei Mandt's paper Also, the exploits use my Pool...

slowloris

slowloris.py - Pythonで書かれたシンプルなSlowloris Slowlorisとは？ Slowlorisは基本的に、スレッド型サーバーに影響を与えるHTTPサービス拒否攻撃です。仕組みは次のとおりです。 1. 大量のHTTPリクエストを開始します。 2. 接続を維持するために、定期的（約15秒ごと）にヘッダーを送信します。 3. サーバーが閉じない限り、接続を閉じません。サーバーが接続を閉じた場合は、新しい接続を作成して同じことを続けます。 これにより、サーバーのスレッドプールが枯渇し、サーバーは他の人に応答できなくなります。 引用...

CVE-2025-21333-POC

CVE-2025-21333-POC Proof of Concept that exploits CVE-2025-21333 in vkrnlintvsp.sys not so reliable see Requirements and Limitations section. Under the References section are located very helpful resources for who wants to play with the exploit. A detailed analysis of the vulnerability and the...

outlook-auto-register

Outlook Auto Register Microsoft Outlook 纯协议批量注册 · PerimeterX 打码 · Web 控制台 · 代理池 / 账号池 / 测活一体化 它解决什么 · 界面预览 · 快速开始 · 代理推荐 · 防封策略 · English · Tiếng Việt · Telegram 本仓库地址 ：lxf746/outlook-auto-register 本项目仅供学习与研究，不得用于商业违规用途。使用者需自行评估并遵守 Microsoft 服务条款，所产生的一切后果由使用者自行承担。 一句话 ：纯协议 Outlook 批量注册 + Web 控制台，...

SecDrvPoolLeak

SecDrvPoolLeak - A PoC for CVE-2018-7250 Description An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 before KB3086255, and as shipped in Macrovision SafeDisc. An uninitialized kernel pool allocation in IOCTL 0xCA002813 allows a...

Malicious code in ultimate-websocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7574e423b830695141ee6e089006e0c355109e240c69881512806869cfee8114 package.json declares its only dependency node-net-pool as a bare tarball URL pointing at the mutable main branch of an unrelated GitHub user...

Pool-Overflow-CVE-2021-31956

Pool-Overflow-CVE-2021-31956...

CVE-2022-25262

CVE-2022-25262 CVE-2022-25262 の PoC + 脆弱性詳細 | JetBrains Hub シングルクリック SAML レスポンス乗っ取り CVE-2022-25262 要件 使用方法 仕組み 「OAuth2 - SAML」交換のための認可コードプール YouTrack Konnector OAuth2 認可コードの奪取（仕様による） 緩和策 要件 JetBrains Hub GET /get-exploit-li...

CVE-2022-34715-POC

CVE-2022-34715-POC CVE-2022-34715-POC pcap nfssvr.sys version 10.0.20348.825 0: kd r rax=0000000080000001 rbx=0000000000000000 rcx=ffffde87fe461150 rdx=0000000000000000 rsi=fffff8040811aa50 rdi=0000000000000008 rip=fffff80408067dbb rsp=ffffb400eb3e2630 rbp=ffffb400eb3e26b9 r8=0000001000000020...