115 matches found
Raccine
Raccine Una protección sencilla contra el ransomware Por qué Con frecuencia vemos ransomware que elimina todas las copias de sombra mediante vssadmin. ¿Y si pudiéramos interceptar esa petición y matar el proceso que la invoca? Intentemos crear una vacuna sencilla. Cómo funciona Registramos un...
Invoke-HiveNightmare
Invoke-HiveNightmare 基于PowerShell的CVE-2021-36934概念验证（PoC），使标准用户能够检索Windows 10版本1809或更新版本中的SAM、安全及软件注册表配置单元（Registry hives）。 情况说明 在特定版本的Windows 10中，标准用户对SYSTEMROOT\System32\Config目录下的文件拥有读取/执行权限，而该目录正是注册表配置单元在磁盘上的存放位置。不过，用户无法直接导航到该目录并复制粘贴，因为配置单元在系统启动时会加载到内存中并被锁定。如果存在卷影副本（Volume Shadow...
IRTriage
Incident Response Triage: Raccolta scriptata di informazioni di sistema utili per un analista forense. IRTriage verrà automaticamente eseguito "Come AMMINISTRATORE" in tutte le versioni di Windows ad eccezione di WinXP. La fonte originale era Triage-ir v0.851, uno script Autoit scritto da Michael...
ransomware-simulator
QuickBuck - Simulatore di Ransomware root@kitploit: / \ / / / / / / // // // // // // '// |/ // // // '/ \\,/// ///\// ,/ ///\ Nextron Systems GmbH L'obiettivo di questo repository è fornire un modo semplice e innocuo per verificare la protezione del tuo antivirus contro i ransomware. Questo...
Anti-Forensics
Anti-Forensics Un Repository per Tracciare le Tecniche Anti-Forensic Questa lista è stata costruita sulla base delle risposte della community DFIR e delle tecniche che attualmente copriamo nel nostro corso di Anti-Forensics. Hai qualche bella idea Anti-Forensic da condividere? DFIR DigitalForensi...
poc_CVE-2021-36934
pocCVE-2021-36934 POC-Experimente mit Volume Shadow copy Service VSS...
vss-fr2system
vss-fr2system Zwei kleine Tools, die einen Arbitrary File Read -Bug unter Windows in eine SYSTEM-Shell verwandeln. vssfreeze/ — erstellt als Standardbenutzer einen Volume Shadow Copy und hält ihn offen, sodass Sie Zeit haben, die SAM-/SECURITY-/SYSTEM-Hives daraus auszulesen fr2system/ — nimmt di...
SAMDump
SAMDump Estrae i file SAM e SYSTEM di Windows utilizzando Volume Shadow Copy Service VSS con molteplici opzioni di esfiltrazione e offuscamento XOR: Elenca le copie shadow del volume utilizzando VSS e ne crea una se necessario Estrae i file SAM e SYSTEM dalla copia shadow Utilizza chiamate API NT...
honda
RoguePlanet di Nightmare-Eclipse HONDA di nu11secur1ty Vulnerabilità di Windows Defender in RoguePlanet Autori: Sviluppatore originale dell'exploit Nightmare-Eclipse Sviluppo, test e weaponizzazione nu11secur1ty Ingegnere di Penetration Testing 🧠 Analisi Tecnica di nu11secur1ty L'exploit sfrutta...
smbexec
root@kitploit: smbexec A rapid psexec style attack with samba tools Original Concept and Script by Brav0Hax & PureHate Ported to ruby and modified by Smilingraccoon and Zeknox Codename - Machiavellian Written because we got sick of Metasploit PSExec getting popped Special thanks to Carnal0wnage...
Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation
Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation By Adithya Chandra and Maulik Maheta · August 18, 2026 Executive Summary While attackers continuously cycle through new tooling, their underlying techniques remain remarkably consistent. Credential theft from...
Windows Defender (MsMpEng.exe) - Race Condition
Titles: Windows Defender MsMpEng.exe - Race Condition Author: nu11secur1ty Date: 2026-06-11 Vendor: Microsoft Corporation Software: Windows Defender Antivirus MsMpEng.exe Reference: https://gitlab.com/nu11secur1ty/0/-/raw/main/README.md?reftype=heads Description: A race condition exists between...
Security Bulletin: IBM System Storage Support for Microsoft Volume Shadow Copy Service and Virtual Disk Service is vulnerable due to jackson-core. (CVE-2025-52999)
Summary jackson-core-2.13.1.jar is updated to jackson-core-2.18.3.jar in the latest IBM System Storage Support for Microsoft Volume Shadow Copy Service and Virtual Disk Service repo where security vulnerability is not observed. CVE-2025-52999. Vulnerability Details CVEID:CVE-2025-52999 DESCRIPTIO...
MiracleLinux 4 : samba-3.6.23-24.AXS4 (AXSA:2016-013:01)
The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-013:01 advisory. Samba is the suite of programs by which a lot of PC-related machines share files, printers, and other information such as lists of available files an...
MiracleLinux 7 : samba-4.2.3-11.el7 (AXSA:2016-023:01)
The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-023:01 advisory. Samba is the standard Windows interoperability suite of programs for Linux and Unix. Security issues fixed with this release: CVE-2015-3223 The...
MiracleLinux 4 : samba4-4.0.0-67.AXS4.rc4 (AXSA:2016-012:01)
The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-012:01 advisory. Samba is the standard Windows interoperability suite of programs for Linux and Unix. Security issues fixed with this release: CVE-2015-3223 The...
Security Bulletin: IBM System Storage Support for Microsoft Volume Shadow Copy Service and Virtual Disk Service is vulnerable to denial of service due to jackson- core. WS-2022-0468.
Summary IBM System Storage Support for Microsoft Volume Shadow Copy Service and Virtual Disk Service is vulnerable to denial of service due to jackson- core. WS-2022-0468. Vulnerability Details WSID: WS-2022-0468 DESCRIPTION: The jackson-core package is vulnerable to a Denial of Service DoS attac...
Security Bulletin: IBM System Storage Support for Microsoft Volume Shadow Copy Service and Virtual Disk Service is vulnerable to an improper input validation vulnerability due to Apache Axis. CVE-2023-51441.
Summary IBM System Storage Support for Microsoft Volume Shadow Copy Service and Virtual Disk Service is vulnerable to an improper input validation vulnerability due to Apache Axis. CVE-2023-51441. Vulnerability Details CVEID:CVE-2023-51441 DESCRIPTION: UNSUPPORTED WHEN ASSIGNED Improper Input...
Security Bulletin: IBM System Storage Support for Microsoft Volume Shadow Copy Service and Virtual Disk Service is vulnerable to multiple vulnerabilities due to Apache Axis. CVE-2018-8032, CVE-2014-3596, CVE-2019-0227, CVE-2012-5784
Summary IBM System Storage Support for Microsoft Volume Shadow Copy Service and Virtual Disk Service is vulnerable to multiple vulnerabilities due to Apache Axis. CVE-2018-8032, CVE-2014-3596, CVE-2019-0227, CVE-2012-5784. Vulnerability Details CVEID:CVE-2018-8032 DESCRIPTION: Apache Axis 1.x up ...
