CVE-2018-8410

CVE-2018-8410 PoC for for Windows Kernel Registry Elevation of Privilege Vulnerability...

CLSIDFinder

CLSIDFinder Invoke-CLSIDFinder enumerates CLSID and AppID entries from the Windows registry to identify COM objects associated with Windows services via the LocalService value. The function correlates these entries, exports the results to a CSV file, and attempts COM activation when the related...

CVE-2021-36934

CVE-2021-36934 root@kitploit: python secretsdump.py -sam C:\Windows\Temp\SAM -security C:\Windows\Temp\SECURITY -system C:\Windows\Temp\SYSTEM LOCAL...

PrintNightmare-Patcher

Introduction PrintNightmare-Patcher, a simple tool that resolves the PrintNightmare vulnerability, which occurs to print spooler service for Windows machines CVE-2021-34527. In addition, it checks if your system has the relevant security update for it or not. Installation root@kitploit: git clone...

Fix-CVE-2023-36884

Fix-CVE-2023-36884.ps1 Temporary solution to mitigate the vulnerability CVE-2023-36884. This vulnerability affects the Windows operating system and may allow remote code execution. CVE-2023-36884 » CVE-2023-36884 The CVE-2023-36884 vulnerability, which is a critical security flaw that can result ...

CVE-2026-90651

Socket Firewall socketdev/socket-registry-firewall in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the apisslverify and upstreamsslverify configuration keys are omitted from socket.yml, the generated configuration sets SOCKETAPISSLVERIFY='false' and...

CVE-2026-90651

Socket Firewall socketdev/socket-registry-firewall in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the apisslverify and upstreamsslverify configuration keys are omitted from socket.yml, the generated configuration sets SOCKETAPISSLVERIFY='false' and...

CVE-2026-90651

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When api_ssl_verify and upstream_ssl_verify are omitted from socket.yml, the generated OpenResty/Lua HTTP client accepts any certificate without chain validatio...

CVE-2026-90651

Socket Firewall socketdev/socket-registry-firewall in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the apisslverify and upstreamsslverify configuration keys are omitted from socket.yml, the generated configuration sets SOCKETAPISSLVERIFY='false' and...

CVE-2024-4573-Mitigation-Script

CVE-2024-4573-Mitigation-Script CVE-2024-43451 is a vulnerability in systems that allow NTLM authentication, a legacy protocol that can be exploited for credential relay attacks or brute force attacks. This vulnerability arises when NTLM is enabled, leaving systems susceptible to unauthorized...

CVE-2022-30190_Temporary_Fix

🩹CVE-2022-30190 Temporary Fix🩹 These are two Python scripts compiled to easily and quickly apply temporary protection against the CVE-2022-30190 vulnerability Follina Both can be programmed better, but this is just to implement it as quickly as possible and I did it without much Python knowledge,...

LAB-DFIR-cve-2023-38831

LAB-DFIR-cve-2023-38831 This lab simulates a CVE-2023–38831 attack and must investigate diskimage and contains a variety of questions including understanding the Windows registry, NTFS files, cache browser, and a complete understanding of the functions that come out of Windows in the sequence of...

Fix-WinVerifyTrustSignatureValidationVuln

Fix-WinVerifyTrustSignatureValidationVuln Fix WinVerifyTrust Signature Validation Vulnerability, CVE-2013-39001, QID-3783322 This Fix is intended for 64-bit Windows Computers This PowerShell code is one way to fix the vulnerability - aside from creating a .reg file and using reg import to import...

Follina-Workaround-CVE-2022-30190

Follina workaround CVE-2022-30190 Description These two scripts can be used to apply the workaround provided by Microsoft to mitigate the vulnerability CVE-2022-30190 as detailed in the MSRC blog and to restore the workaround, should an official patch be released. The first script...

CVE-2024-37032

CVE-2024-37032 Path traversal in Ollama with rogue registry server Learn from Probllama: Ollama Remote Code Execution Vulnerability CVE-2024-37032 – Overview and Mitigations Vulnerability environment root@kitploit: docker run -d -v ollama:/root/.ollama -p 11434:11434 --name ollama...

CVE-2013-3900_Remediation_PowerShell

CVE-2013-3900RemediationPowerShell Script to make changes on registry to fix CVE-2013-3900. It comes with an option to undo in case it breaks something on your environment. Steps Download the script, run it with Admin Privileges, reboot the machine...

ATP-PowerShell-Scripts

ATP-PowerShell-Scripts Microsoft Signed PowerShell scripts List of all the signed scripts available in C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection Accessing the file By default the files cannot be accessed. You need the TrustedInstaller privilege...

persistence-info.github.io

The repository tries to gather an information about Windows persistence mechanisms to make the protection/detection more efficient. Most of the information is well known for years, being actively used within various scenarios. Expect more. I am doing my best to add new entries each day. How it...

BOF_Collection

BOFCollection Various Cobalt Strike BOFs Requirements beacon.h For compilation instructions and BOF overview help-bof ActiveDirectory GetDomainInfo.c Returns information on the current domain and domain controller. inline-execute GetDomainInfo.o Collection GetClipboard.c Prints any text on the...

MoreImpacketExamples

MoreImpacketExamples This repository contains a few short python scripts that were created using the Impacket library. The primary goal of this project is to help myself and others who are looking to transition from using the provided impacket examples to modifying/creating scripts of their own...