Occ

Prohibited Items Segmentation via Occlusion-aware Bilayer Modeling ICME 2025 Official PyTorch Implementation of Prohibited Items Segmentation via Occlusion-aware Bilayer Modeling. Paper link: IEEE, Arxiv. Get Started Dependencies Code is successfully tested on Linux with Pytorch 2.1.2 and CUDA...

BlueSAM

BlueSAM BOF A Cobalt Strike Beacon Object File adaptation of BlueHammer that attempts to obtain a copy of the SAM database through Windows Defender update/VSS behavior and process offline registry data from Beacon. Credits to Nightmare-Eclipse's BlueHammer...

serverless-application-model

AWS SAM transform The AWS Serverless Application Model AWS SAM transform is a AWS CloudFormation macro that transforms SAM templates into CloudFormation templates. To use the SAM transform, add to the of your CloudFormation template...

PyNightmare

PyNightmare PoC for CVE-2021-36934 Aka HiveNightmare/SeriousSAM fully written in python3 Explanation CVE-2021-36934 is a recently discovered vulnerability found by @jonasLyk allowing non-admin users to copy all registry hives which contain very private information like hashes which could lead to...

ShadowSteal

ShadowSteal | CVE-2021-36934 Pure Nim implementation for exploiting CVE-2021-36934, the SeriousSAM Local Privilege Escalation LPE. Not OPSEC safe.... yet ;. I do not claim credit for the discovery of this exploit. Quick Start Build with Docker Getting started with ShadowSteal is now easier than...

silph

SILPH: Stealthy In-Memory Local Password Harvester SILPH is an open-source red team tool designed to dump LSA secrets, SAM hashes, and DCC2 credentials entirely in memory, without writing any files to disk. Unlike its upstream project go-secdump , SILPH is built to be integrated into the Orsted C...

SilentNimvest

SilentNimvest Basically, SilentNimvest is a SAM and Security Hives parser written in Nim. SilentNimvest reads keys under these hives by using the Silent Harvest technique. With this technique, rather than a SYSTEM-level privilege, a plain Administrator account who enables SeBackupPrivilege thanks...

checkov

...

HiveJack

HiveJack This tool can be used during internal penetration testing to dump Windows credentials from an already-compromised host. It allows one to dump SYSTEM, SECURITY and SAM registry hives and once copied to the attacker machines provides an option to delete these files to clear the trace. Ofte...

go-secdump

go-secdump Description Package go-secdump is a tool built to remotely extract hashes from the SAM registry hive as well as LSA secrets and cached hashes from the SECURITY hive without any remote agent and without touching disk. The tool is built on top of the library go-smb and use it to...

go-secdump

go-secdump Descripción El paquete go-secdump es una herramienta diseñada para extraer de forma remota hashes del hive del registro SAM, así como secretos LSA y hashes en caché del hive SECURITY, sin necesidad de un agente remoto y sin tocar el disco. La herramienta está construida sobre la...

CVE-2021-36934

CVE-2021-36934 CVE-2021-36934 PowerShell scripts Detection.ps1 This is a quick and dirty script to see if a machine may be vulnerable. It writes out a message to the shell indicating if BUILTIN\Users was detected in the permission list and includes the current permissions on the SAM path for...

PrettyPrague

PrettyPrague GenDigital Avast Antivirus ZeroDay Elevation of Privileges Vulnerability Another zeroday in an antimalware provider, I'm not sure but I believe this vulnerability affect other GenDigital products as well such as AVG, Norton... For now the PoC is compatible with any version of Avast...

ophcrack

OPHCRACK 3.6.0 Time-Memory-Trade-Off-Crack A windows password cracker based on the faster time-memory trade-off using rainbow tables. This is an evolution of the original ophcrack 1.0 developed at EPFL http://lasecwww.epfl.ch/oechslin/projects/ophcrack Ophrack 3.6.0 comes with a Qt Graphical User...

BackupOperatorToDA

From Backup Operator To Domain Admin If you compromise an account member of the group Backup Operators you can become the Domain Admin without RDP or WinRM on the Domain Controller. All credit from filipdragovic with his inital POC ! I build this project because I wanted to have a more generic...

SharpSecDump

SharpSecDump .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py. By default runs in the context of the current user. Please only use in environments you own or have permission to test against : Usage SharpSecDump.exe -target=192.168.1.15 -u=admin...

SAMDump

SAMDump Extrae archivos SAM y SYSTEM de Windows usando el Servicio de Copia de Sombra de Volumen VSS con múltiples opciones de exfiltración y ofuscación XOR: Lista las copias de sombra de volumen usando VSS y crea una si es necesario Extrae los archivos SAM y SYSTEM de la copia de sombra Utiliza...

redsnarf

root@kitploit: . \ \ | / / / \ | // \ / |\ \ / \ \ \ \ | | \ // // |/ \ | / | | /| | || /\ / /| /| || / / / / / / [email protected] @redsnarf RedSnarf is a pen-testing / red-teaming tool by Ed Williams for retrieving hashes and credentials from Windows workstations, servers and...

CVE-2021-36934

CVE-2021-36934 Usage Detection root@kitploit: .\Get-HiveNightmareStatus.ps1 Detection for management tools that need True/False output root@kitploit: .\Get-HiveNightmareStatus.ps1 -PostureCheck Remediation root@kitploit: For initial SAM fixes and vss removal .\Get-HiveNightmareStatus.ps1 -Remedia...

ranger

ranger A tool to support security professionals access and interact with remote Microsoft Windows based systems. This project was conceptualized with the thought process, we did not invent the bow or the arrow, just a more efficient way of using it. Ranger is a command-line driven attack and...