IRTriage

Incident Response Triage: Scripted collection of system information valuable to a Forensic Analyst. IRTriage will automatically "Run As ADMINISTRATOR" in all Windows versions except WinXP. The original source was Triage-ir v0.851 an Autoit script written by Michael Ahrendt. Unfortunately Michael'...

ransomware-simulator

QuickBuck - Ransomware Simulator root@kitploit: / \ / / / / / / // // // // // // '// |/ // // // '/ \\,/// ///\// ,/ ///\ Nextron Systems GmbH The goal of this repository is to provide a simple, harmless way to check your AV's protection on ransomware. This tool simulates typical ransomware...

vss-fr2system

vss-fr2system Two small tools that turn an arbitrary file read bug on Windows into a SYSTEM shell. vssfreeze/ — creates a Volume Shadow Copy as a standard user , then holds it open so you have time to read the SAM/SECURITY/SYSTEM hives out of it fr2system/ — takes the hives you copied out, decryp...

Raccine

Raccine A Simple Ransomware Protection Why We see ransomware delete all shadow copies using vssadmin pretty often. What if we could just intercept that request and kill the invoking process? Let's try to create a simple vaccine. How it works We register a debugger for vssadmin.exe and wmic.exe,...

SAMDump

SAMDump ボリュームシャドウコピーサービス VSS を使用してWindowsのSAMおよびSYSTEMファイルを抽出し、複数の流出オプションとXOR難読化を提供するツール： VSSを使用してボリュームシャドウコピーを一覧表示し、必要に応じて作成する シャドウコピーからSAMおよびSYSTEMファイルを抽出する ファイル操作にNT APIコールを使用 NtCreateFile , NtReadFile , NtWriteFile XORエンコードによる難読化をサポート 流出方法: ローカル保存 または ネットワーク転送...

Invoke-HiveNightmare

Invoke-HiveNightmare PowerShell-based PoC for CVE-2021-36934, which enables a standard user to be able to retrieve the SAM, Security, and Software Registry hives in Windows 10 version 1809 or newer. Situation In specific versions of Windows 10, standard users have read/execute rights to files in...

poc_CVE-2021-36934

pocCVE-2021-36934 POC experiments with Volume Shadow copy Service VSS...

smbexec

root@kitploit: smbexec A rapid psexec style attack with samba tools Original Concept and Script by Brav0Hax & PureHate Ported to ruby and modified by Smilingraccoon and Zeknox Codename - Machiavellian Written because we got sick of Metasploit PSExec getting popped Special thanks to Carnal0wnage...

honda

RoguePlanet by Nightmare-Eclipse HONDA by nu11secur1ty RoguePlanet Windows Defender Vulnerability Authors: Original Exploit Developer Nightmare-Eclipse Developing, testing, and weaponization nu11secur1ty Penetration Testing Engineer 🧠 Technical Analysis by nu11secur1ty The exploit leverages a rac...

Anti-Forensics

Anti-Forensics A Repository to Track Anti-Forensic Techniques This list is built based on the response of the DFIR community and the techniques we currently cover in our Anti-Forensics course. Do you have any cool Anti-Forensic ideas to share? DFIR DigitalForensics...

CVE-2026-72985

Heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges with a physical attack...

CVE-2026-72985

A heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker with physical access to escalate privileges, potentially compromising confidentiality, integrity, and availability (CVSS 6.8, MEDIUM). The vulnerability requires no prior privileges or user interaction, but...

EUVD-2026-73737

Heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges with a physical attack...

Volume Shadow Copy Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges with a physical attack...

Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation

Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation By Adithya Chandra and Maulik Maheta · August 18, 2026 Executive Summary While attackers continuously cycle through new tooling, their underlying techniques remain remarkably consistent. Credential theft from...

Windows Defender (MsMpEng.exe) - Race Condition

Titles: Windows Defender MsMpEng.exe - Race Condition Author: nu11secur1ty Date: 2026-06-11 Vendor: Microsoft Corporation Software: Windows Defender Antivirus MsMpEng.exe Reference: https://gitlab.com/nu11secur1ty/0/-/raw/main/README.md?reftype=heads Description: A race condition exists between...

Security Bulletin: IBM System Storage Support for Microsoft Volume Shadow Copy Service and Virtual Disk Service is vulnerable due to jackson-core. (CVE-2025-52999)

Summary jackson-core-2.13.1.jar is updated to jackson-core-2.18.3.jar in the latest IBM System Storage Support for Microsoft Volume Shadow Copy Service and Virtual Disk Service repo where security vulnerability is not observed. CVE-2025-52999. Vulnerability Details CVEID:CVE-2025-52999 DESCRIPTIO...

MiracleLinux 4 : samba-3.6.23-24.AXS4 (AXSA:2016-013:01)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-013:01 advisory. Samba is the suite of programs by which a lot of PC-related machines share files, printers, and other information such as lists of available files an...

MiracleLinux 4 : samba4-4.0.0-67.AXS4.rc4 (AXSA:2016-012:01)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-012:01 advisory. Samba is the standard Windows interoperability suite of programs for Linux and Unix. Security issues fixed with this release: CVE-2015-3223 The...

MiracleLinux 7 : samba-4.2.3-11.el7 (AXSA:2016-023:01)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-023:01 advisory. Samba is the standard Windows interoperability suite of programs for Linux and Unix. Security issues fixed with this release: CVE-2015-3223 The...