swarmer

swarmer Una herramienta para agregar sigilosamente claves de registro a HKCU sin que EDR/AV pueda ver lo que está sucediendo incluso si no tienes acceso de administrador. ¿Cómo uso esto? NOTA: Solo podrás hacer esto UNA VEZ, después de queNTUSER.MAN sea tu nuevo hive del registro, NO podrás...

persistence-info.github.io

El repositorio intenta recopilar información sobre los mecanismos de persistencia de Windows para hacer que la protección/detección sea más eficiente. La mayor parte de la información es bien conocida desde hace años y se utiliza activamente en diversos escenarios. Espera más. Hago todo lo posibl...

SharpStay

SharpStay - .NET 持久化 构建 打开 Visual Studio 项目并编译为发布版本。 选项 提权注册表项 提权 UserInit 注册表项 提权计划任务 提权创建服务 提权 WMI 事件订阅 非提权 InitMprLogonScript 注册表项 非提权计划任务 COM 处理程序劫持 非提权 Junction 文件夹 杂项：添加计划任务操作 杂项：启动目录 杂项：新建 LNK 杂项：后门 LNK 杂项：任务名称 杂项：列出计划任务 杂项：列出运行中的服务 杂项：获取计划任务 COM 处理程序 Sharpstay.exe action=ElevatedRegistryK...

VMwareCloak

VMwareCloak Un script de PowerShell que intenta ayudar a los analistas de malware a ocultar sus máquinas virtuales VMware de Windows del malware que pueda estar intentando evadir el análisis. Garantizado para bajar tus puntuaciones en pafish por al menos algunos puntos ; El script logra esto...

UAC-Elevation-CVE

CVE-2021-31956: Exploit de elevación de privilegios de UAC en Windows Descripción general CVE-2021-31956 es una vulnerabilidad de omisión de UAC Control de cuentas de usuario en Windows que permite a un atacante elevar privilegios a SYSTEM sin activar un aviso de UAC. Este CVE explota un fallo en...

Fix-CVE-2023-36884

Fix-CVE-2023-36884.ps1 Solución temporal para mitigar la vulnerabilidad CVE-2023-36884. Esta vulnerabilidad afecta al sistema operativo Windows y puede permitir la ejecución remota de código malicioso. CVE-2023-36884 » CVE-2023-36884 La vulnerabilidad CVE-2023-36884, que es una falla de seguridad...

EUVD-2025-210211

Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can lead to bypassing the NSClient Tamper Protections due to weak Discretionary Access Control List DACLs on the service object and related registry keys,. Produc...

CVE-2025-15642

Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can lead to bypassing the NSClient Tamper Protections due to weak Discretionary Access Control List DACLs on the service object and related registry keys,. Produc...

CVE-2025-15642 Netskope Client Service Insufficient Access Controls

Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can lead to bypassing the NSClient Tamper Protections due to weak Discretionary Access Control List DACLs on the service object and related registry keys,. Produc...

CVE-2025-15642

The CVE-2025-15642 entry concerns Netskope Client for Windows. The issue is described as weak discretionary access control lists on the Netskope Client service object and related registry keys, allowing a malicious insider with admin privileges to bypass NSClient Tamper Protections. Affected: Net...

CVE-2025-15642 Netskope Client Service Insufficient Access Controls

Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can lead to bypassing the NSClient Tamper Protections due to weak Discretionary Access Control List DACLs on the service object and related registry keys,. Produc...

ATBroker Registry Security Scanner

This code is a defensive Windows security scanner designed to audit potentially sensitive Registry paths related to ATBroker Accessibility Technology Broker and core system hives. It only checks for the presence of certain registry keys to see if they're protected or accessible...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the...

Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

Impact On Windows, app.setAsDefaultProtocolClientprotocol did not validate the protocol name before writing to the registry. Apps that pass untrusted input as the protocol name may allow an attacker to write to arbitrary subkeys under HKCU\Software\Classes, potentially hijacking existing protocol...

CVE-2026-1716

An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to delete arbitrary registry keys with elevated privileges...

CVE-2026-1715

An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to modify arbitrary registry keys with elevated privileges...

NVIDIA B300 MCU 安全漏洞

NVIDIA B300 MCU is a micro-control unit component developed by NVIDIA Corporation, used for managing and controlling hardware devices. The NVIDIA B300 MCU has a security vulnerability; this vulnerability stems from the CX8 MCU allowing modifications to unsupported registry keys, which may lead to...

Exploit for Incorrect Permission Assignment for Critical Resource in Microsoft

RegPwn BOF for Brute Ratel C4 My Brute Ratel C4 BOF reimpleme...

Microsoft Windows Image File Execution Options (IFEO) Persistence

This PHP script leverages legitimate Windows debugging features to establish persistent remote access. This technique leverages the Image File Execution Options IFEO registry keys to configure a monitor process that automatically executes when a specified target process exits. Windows allows...

EUVD-2026-11359

An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to delete arbitrary registry keys with elevated privileges...