Digital-Signature-Hijack

Digital Signature Hijack Hijacking legitimate digital signatures is a technique that can be used during red team assessments in order to sign PowerShell code and binaries. This could assist to bypass Device Guard restrictions and maintain stealthy in an engagement. DigitalSignatureHijack is a...

Invoke-SessionHunter

Invoke-SessionHunter Retrieve and display information about active user sessions on remote computers. No admin privileges required. The tool leverages the remote registry service to query the HKEYUSERS registry hive on the remote computers. It identifies and extracts Security Identifiers SIDs...

CVE-2022-30190-Follina-Patch

CVE-2022-30190-Follina-Patch This is a simple program allows you to complete the Workarounds temporary Patch at once instead of typing in cmd Addressed to specific people. Requires you to run it as an administrator. 6/2/2022 Images The exe file Manually Run Command Prompt as Administrator. To bac...

mscache

mscache a tool to manipulate dccdomain cached credentials in windows registry, based mainly on the work of mimikatz and impacket requirements python2 pycrypto passlib impacket example root@kitploit: python mscache.py --security security --system system dumping domain cached credentials reg query...

LegacyHive

LegacyHive : Windows user profile service arbitrary hive load elevation of privileges vulnerability The PoC requires another standard user credentials and a third username which can be an administrator account, if the PoC is successful, it will end up mounting the target user hive in current user...

CVE-2023-36884-Checker

CVE-2023-36884-Checker Script to check for CVE-2023-36884 hardening https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884 Goal This scripts checks if Microsoft hardening recommendations are properly applied. Microsoft says...

OWASP-VWAD

OWASP-VWAD 2024-10-26 ⚠️ This repo is being wound down. Future work should be via www-project-vulnerable-web-applications-directory The OWASP Vulnerable Web Applications Directory Project VWAD, https://owasp.org/www-project-vulnerable-web-applications-directory/ is a comprehensive and well...

r77-rootkit

r77 Rootkit Rootkit sin archivos de ring 3 r77 es un rootkit de ring 3 que oculta todo: Archivos, directorios Procesos y uso de CPU/GPU Claves y valores del registro Servicios Conexiones TCP y UDP Enlaces, named pipes, tareas programadas Ocultación por prefijo Todo lo que comienza con "$77" está...

PowerShell-PrintNightmare

PowerShell-PrintNightmare Una colección de scripts para ayudar a configurar las claves de registro adecuadas para CVE-2021-34527, compartidas como parte de nuestros blogs que describen varias opciones de mitigación. servers.ps1 contiene las configuraciones de registro relacionadas con...

printix-CVE-2022-29552

CVE-2022-29552 Simple Release | Print Friendly A "Incorrect Use of Privileged APIs" vulnerability in PrintixService.exe, in Kofax Printix's "Printix Secure Cloud Print Management", Version 1.3.1156.0 and below allows a Local Or Remote attacker the ability change any values within the...

GhostTask

Ghost Scheduled Task Inspired by WithSecure's research on Scheduled Task Tampering, they explained the feasibility of creating a scheduled task solely through registry key manipulation. Such an approach can bypass the generation of scheduled task creation event logs, such as 4698 and 106, providi...

RegPwnBOF

RegPwn BOF Cobalt Strike BOF port of the RegPwn exploit by Filip Dragovic @Wh04m1001 / MDSec ActiveBreach. This is a sloppy BOF reimplementation of the original C exploit. All credit for the vulnerability research and exploit goes to Filip Dragovic and MDSec. Blog post :...

CVE-2024-23653

root@kitploit: syntax=docker.io/zdfa/evilerfile FROM alpine RUN grep Cap /proc/self/status root@kitploit: sudo bin/buildctl build \ --frontend=dockerfile.v0 \ --local context=. \ --local dockerfile=. root@kitploit: ➜ cp sudo bin/buildctl build \ --frontend=dockerfile.v0 \ --local context=. ...

malicious-devfile-registry

Malicious Devfile Registry The project contains a malicious Devfile Registry usable to exploit CVE-2024-0402 in Gitlab. The Exploit A nodejs:2.2.1 stack is indexed to expose the archive.tar file exploiting the path-traversal issue in registry-support library before v1.1.0. tar location :...

CVE-2020-1350-Fix

KB4569509: Guidance for DNS Server Vulnerability CVE-2020-1350 Introduction On July 14, 2020, Microsoft released a security update for the issue that is described in CVE-2020-1350 | Windows DNS Server Remote Code Execution Vulnerability. This advisory describes a Critical Remote Code Execution RC...

cve-2017-8529

cve-2017-8529 My CVE-2017-8529 files A PowerShell script to configure the registry fix in CVE-2017-8529...

HPE-iMC-7.3-RMI-Java-Deserialization

HPE iMC 7.3 Java RMI Registry Deserialization RCE Vulnerability CVE ID CVE-2017-5792 Exploit Vendor Homepage: www.hpe.com Version: iMC PLAT v7.3 E0504 Standard Tested on: Windows Server 2008 R2 Enterprise 64-bit note that this PoC will launch calc.exe $ java -cp ysoserial-0.0.6-SNAPSHOT-all.jar...

Registry-Spy

Registry Spy: Cross-Platform Windows Registry Browser Registry Spy is a free, open-source cross-platform Windows Registry viewer. It is a fast, modern, and versatile explorer for raw registry files. Features include: Windows, macOS, and Linux support Fast, on-the-fly parsing means no upfront...

Disable-IPv6-CVE-2024-38063-Fix

Disable IPv6 to Mitigate CVE-2024-38063 Without Installing KB Update Overview This script is designed to mitigate the effects of the critical vulnerability CVE-2024-38063, a remote code execution RCE vulnerability in the Windows TCP/IP stack related to IPv6. By disabling IPv6 on the system, this...

Invoke-HiveNightmare

Invoke-HiveNightmare PowerShell-based PoC for CVE-2021-36934, which enables a standard user to be able to retrieve the SAM, Security, and Software Registry hives in Windows 10 version 1809 or newer. Situation In specific versions of Windows 10, standard users have read/execute rights to files in...