vss-fr2system

vss-fr2system Dos pequeñas herramientas que convierten un fallo de lectura arbitraria de archivos en Windows en un shell SYSTEM. vssfreeze/ — crea una copia de sombra de volumen como usuario estándar , luego la mantiene abierta para que tengas tiempo de leer los archivos SAM/SECURITY/SYSTEM de el...

poc_CVE-2021-36934

pocCVE-2021-36934 POC experimentos con Volume Shadow copy Service VSS...

SAMDump

SAMDump Extrae archivos SAM y SYSTEM de Windows usando el Servicio de Copia de Sombra de Volumen VSS con múltiples opciones de exfiltración y ofuscación XOR: Lista las copias de sombra de volumen usando VSS y crea una si es necesario Extrae los archivos SAM y SYSTEM de la copia de sombra Utiliza...

Raccine

Raccine A Simple Ransomware Protection Why We see ransomware delete all shadow copies using vssadmin pretty often. What if we could just intercept that request and kill the invoking process? Let's try to create a simple vaccine. How it works We register a debugger for vssadmin.exe and wmic.exe,...

Invoke-HiveNightmare

Invoke-HiveNightmare PoC basado en PowerShell para CVE-2021-36934, que permite a un usuario estándar recuperar los archivos SAM, Security y Software Registry en Windows 10 versión 1809 o posterior. Situación En versiones específicas de Windows 10, los usuarios estándar tienen permisos de...

IRTriage

Triage de Respuesta a Incidentes: Recopilación automatizada de información del sistema valiosa para un Analista Forense. IRTriage se ejecutará automáticamente "Como ADMINISTRADOR" en todas las versiones de Windows excepto WinXP. La fuente original fue Triage-ir v0.851, un script Autoit escrito po...

smbexec

smbexec A rapid psexec style attack with samba tools Original Concept and Script by Brav0Hax & PureHate Ported to ruby and modified by Smilingraccoon and Zeknox Codename - Machiavellian Written because we got sick of Metasploit PSExec getting popped Special thanks to Carnal0wnage who's blog...

ransomware-simulator

QuickBuck - Simulador de Ransomware / \ / / / / / / // // // // // // '// |/ // // // '/ \\,/// ///\// ,/ ///\ Nextron Systems GmbH El objetivo de este repositorio es proporcionar una forma simple e inofensiva de verificar la protección de tu antivirus contra ransomware. Esta herramienta...

SrHollow

SrHollow LSA secrets extraction, reuse a preexisting VSS shadow copy + inline regf parser + AES-256 LSA decrypt via bcrypt.dll. Chain in 6 steps 1. Enumerate\GLOBAL?? via NtOpenDirectoryObject + NtQueryDirectoryObject. Pick the highest-numbered HarddiskVolumeShadowCopyN. 2. If none exists , fall...

honda

RoguePlanet di Nightmare-Eclipse HONDA di nu11secur1ty Vulnerabilità di Windows Defender in RoguePlanet Autori: Sviluppatore originale dell'exploit Nightmare-Eclipse Sviluppo, test e weaponizzazione nu11secur1ty Ingegnere di Penetration Testing 🧠 Analisi Tecnica di nu11secur1ty L'exploit sfrutta...

Anti-Forensics

Anti-Forensics A Repository to Track Anti-Forensic Techniques This list is built based on the response of the DFIR community and the techniques we currently cover in our Anti-Forensics course. Do you have any cool Anti-Forensic ideas to share? DFIR DigitalForensics...

CVE-2026-72985

Heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges with a physical attack...

CVE-2026-72985

A heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker with physical access to escalate privileges, potentially compromising confidentiality, integrity, and availability (CVSS 6.8, MEDIUM). The vulnerability requires no prior privileges or user interaction, but...

EUVD-2026-73737

Heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges with a physical attack...

Volume Shadow Copy Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges with a physical attack...

PT-2026-87895

Heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges with a physical attack...

CVE-2026-72985: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges with a physical attack...

Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation

Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation By Adithya Chandra and Maulik Maheta · August 18, 2026 Executive Summary While attackers continuously cycle through new tooling, their underlying techniques remain remarkably consistent. Credential theft from...

Windows Defender (MsMpEng.exe) - Race Condition

Titles: Windows Defender MsMpEng.exe - Race Condition Author: nu11secur1ty Date: 2026-06-11 Vendor: Microsoft Corporation Software: Windows Defender Antivirus MsMpEng.exe Reference: https://gitlab.com/nu11secur1ty/0/-/raw/main/README.md?reftype=heads Description: A race condition exists between...

📄 Microsoft Windows Defender MsMpEng.exe Race Condition / Privilege Escalation

A race condition exists between Windows Defender's MpCleanCallbackFunction cleanup routine and Volume Shadow Copy creation. This vulnerability allows an attacker to escalate privileges to NT AUTHORITY\SYSTEM. This Metasploit module demonstrates the issue...