CVE-2021-36934

CVE-2021-36934 root@kitploit: python secretsdump.py -sam C:\Windows\Temp\SAM -security C:\Windows\Temp\SECURITY -system C:\Windows\Temp\SYSTEM LOCAL...

PrintNightmare-Patcher

Introducción PrintNightmare-Patcher, una herramienta simple que soluciona la vulnerabilidad PrintNightmare, que ocurre en el servicio de cola de impresión para máquinas Windows CVE-2021-34527. Además, verifica si su sistema tiene la actualización de seguridad correspondiente o no. Instalación...

Fix-CVE-2023-36884

Fix-CVE-2023-36884.ps1 Solución temporal para mitigar la vulnerabilidad CVE-2023-36884. Esta vulnerabilidad afecta al sistema operativo Windows y puede permitir la ejecución remota de código malicioso. CVE-2023-36884 » CVE-2023-36884 La vulnerabilidad CVE-2023-36884, que es una falla de seguridad...

CVE-2026-90651

Socket Firewall socketdev/socket-registry-firewall in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the apisslverify and upstreamsslverify configuration keys are omitted from socket.yml, the generated configuration sets SOCKETAPISSLVERIFY='false' and...

CVE-2026-90651

Socket Firewall socketdev/socket-registry-firewall in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the apisslverify and upstreamsslverify configuration keys are omitted from socket.yml, the generated configuration sets SOCKETAPISSLVERIFY='false' and...

CVE-2026-90651

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When api_ssl_verify and upstream_ssl_verify are omitted from socket.yml, the generated OpenResty/Lua HTTP client accepts any certificate without chain validatio...

CVE-2026-90651

Socket Firewall socketdev/socket-registry-firewall in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the apisslverify and upstreamsslverify configuration keys are omitted from socket.yml, the generated configuration sets SOCKETAPISSLVERIFY='false' and...

CVE-2024-4573-Mitigation-Script

CVE-2024-4573-Mitigation-Script CVE-2024-43451 es una vulnerabilidad en sistemas que permiten la autenticación NTLM, un protocolo heredado que puede ser explotado para ataques de reenvío de credenciales o ataques de fuerza bruta. Esta vulnerabilidad surge cuando NTLM está habilitado, dejando a lo...

CVE-2022-30190_Temporary_Fix

🩹CVE-2022-30190 Temporary Fix🩹 These are two Python scripts compiled to easily and quickly apply temporary protection against the CVE-2022-30190 vulnerability Follina Both can be programmed better, but this is just to implement it as quickly as possible and I did it without much Python knowledge,...

LAB-DFIR-cve-2023-38831

LAB-DFIR-cve-2023-38831 This lab simulates a CVE-2023–38831 attack and must investigate diskimage and contains a variety of questions including understanding the Windows registry, NTFS files, cache browser, and a complete understanding of the functions that come out of Windows in the sequence of...

Fix-WinVerifyTrustSignatureValidationVuln

Fix-WinVerifyTrustSignatureValidationVuln Fix WinVerifyTrust Signature Validation Vulnerability, CVE-2013-39001, QID-3783322 This Fix is intended for 64-bit Windows Computers This PowerShell code is one way to fix the vulnerability - aside from creating a .reg file and using reg import to import...

Follina-Workaround-CVE-2022-30190

Follina workaround CVE-2022-30190 Description These two scripts can be used to apply the workaround provided by Microsoft to mitigate the vulnerability CVE-2022-30190 as detailed in the MSRC blog and to restore the workaround, should an official patch be released. The first script...

CVE-2024-37032

CVE-2024-37032 Path traversal en Ollama con servidor de registro malicioso Aprende de Probllama: Vulnerabilidad de ejecución remota de código en Ollama CVE-2024-37032 – Descripción general y mitigaciones Entorno de vulnerabilidad root@kitploit: docker run -d -v ollama:/root/.ollama -p 11434:11434...

CVE-2013-3900_Remediation_PowerShell

CVE-2013-3900RemediationPowerShell Script para realizar cambios en el registro para corregir CVE-2013-3900. Incluye una opción para deshacer los cambios en caso de que algo falle en su entorno. Pasos Descargue el script, ejecútelo con privilegios de administrador y reinicie el equipo...

ATP-PowerShell-Scripts

ATP-PowerShell-Scripts Microsoft Signed PowerShell scripts List of all the signed scripts available in C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection Accessing the file By default the files cannot be accessed. You need the TrustedInstaller privilege...

persistence-info.github.io

The repository tries to gather an information about Windows persistence mechanisms to make the protection/detection more efficient. Most of the information is well known for years, being actively used within various scenarios. Expect more. I am doing my best to add new entries each day. How it...

BOF_Collection

BOFCollection Various Cobalt Strike BOFs Requirements beacon.h For compilation instructions and BOF overview help-bof ActiveDirectory GetDomainInfo.c Returns information on the current domain and domain controller. inline-execute GetDomainInfo.o Collection GetClipboard.c Prints any text on the...

MoreImpacketExamples

MoreImpacketExamples This repository contains a few short python scripts that were created using the Impacket library. The primary goal of this project is to help myself and others who are looking to transition from using the provided impacket examples to modifying/creating scripts of their own...

VMwareCloak

VMwareCloak A PowerShell script that attempts to help malware analysts hide their VMware Windows VM's from malware that may be trying to evade analysis. Guaranteed to bring down your pafish ratings by at least a few points ; The script accomplishes this by doing the following: Renames several...

CVE-2026-89332

Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the...