CVE-2026-110831

FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in driveprocessirpcreate, which registers an opened local file in the drive dictionary before applying the allocation size and does not remove it when that operation fails. A malicious RDP server connected to a client with...

juicy-potato

Juicy Potato abusing the golden privileges A sugared version ofRottenPotatoNG, with a bit of juice, i.e. another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM Summary RottenPotatoNG and its variants leverages the privilege escalation chain based on BITS...

vss-fr2system

vss-fr2system Two small tools that turn an arbitrary file read bug on Windows into a SYSTEM shell. vssfreeze/ — creates a Volume Shadow Copy as a standard user , then holds it open so you have time to read the SAM/SECURITY/SYSTEM hives out of it fr2system/ — takes the hives you copied out, decryp...

mpDNS

mpDNS aka multi-purpose DNS Server Simple, configurable DNS Server with multiple useful features Python 3 names.db - holds all custom records see examples Simple wildcards like .example.com Catch unicode dns requests Custom actions aka macro: shellexec::dig google.com +short - Execute shell comma...

CVE-2023-27350

CVE-2023-27350 Exploit POC This is a Proof of Concept POC exploit for CVE-2023-27350, a vulnerability found in PaperCut MF/NG that allows an unauthenticated attacker to execute arbitrary code with SYSTEM privileges. Requirements Before using this exploit, make sure you have installed the followin...

CVE-2026-20637-AppleSEPKeyStore-UAF

CVE-2026-20637: AppleSEPKeyStore Use-After-Free CVE-2026-20637 | Author: Johnny Franks @zeroxjf Component: AppleKeyStore Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. —Apple Security Content, iO...

frida-ios-hook

Frida iOS hook 📍 A tool that helps you can easy using frida. It support script for trace classes, functions, and modify the return values of methods on iOS platform. 👉 For Android platform: frida-android-hook 👉 For Intercept Api was encrypted on iOS application: frida-ios-intercept-api Env OS...

AllTools

AllTools All reasonably stable tools AccessMask - decode access mask for common object types BgInfo - WPF version of the Sysinternals BgInfo tool BITSMgr - BITS jobs manager application CLR Explorer - View .NET process information / dump file CpuStres - thread/CPU stress testing app CpuStress...

kernel: udp: fix potential use-after-free in tunnel segmentation

A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...

shodan

Shodan Dorks by twitter.com/lothos612 Feel free to make suggestions Shodan Dorks Basic Shodan Filters city: Find devices in a particular city. city:"Bangalore" country: Find devices in a particular country. country:"IN" geo: Find devices by giving geographical coordinates...

CVE-2023-23752

CVE-2023-23752 Joomla Unauthorized Access Vulnerability CVE-2023-23752 Vulnerability Description Joomla is an open-source content management system CMS, written in PHP, supporting multiple database systems such as MySQL, MSSQL, and PostgreSQL. Improper access restrictions lead to unauthorized...

lazyrecon

/ \ / / \ /// / // Y / \ /| | | | / | / / \ / | /|| \ | / | / || |\ || | |/| |-||/ / / / | /| / | | /|| | || // |/// /\\|// | Usage ./lazyrecon.sh -d domain.com To exclude particular subdomains: ./lazyrecon.sh -d domain.com -e excluded.domain.com,other.domain.com About...

CVE-Factory

CVE-Factory: Scaling Expert-Level Agentic Tasks for Code Security Vulnerability CVE-Factory is a Multi-Agent system for fully automated, end-to-end CVE reproduction. Given CVE records, the system automatically researches details, generates test cases, builds Docker environments, and validates tha...

CVE-2019-1388

CVE-2019-1388 guest→System UAC manual privilege escalation, gif is a bit slow, please wait References http://www.svenbeast.com/post/OsMblUp6w/ https://github.com/Lz1y/imggo...

CVE-2022-40471

CVE-2022-40471 Remote code execution via unrestricted file upload vulnerability in the Clinic's Patient Management System v 1.0 Technical description: Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload...

CVE-2022-26503

CVE-2022-26503 Summary: Vulnerability CVE-2022-26503 in Veeam Agent for Microsoft Windows allows local privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code with LOCAL SYSTEM privileges. Shout out to @ultrayoba The Patch: The implemented patch...

CVE-2025-59287

In this study, we will examine a critical vulnerability CVE-2025-59287 discovered in the Microsoft Windows Server Update Services WSUS environment. This vulnerability arises from the unsafe deserialization of AuthorizationCookie objects sent to the GetCookie endpoint, where encrypted cookie data ...

SysWhispers2

SysWhispers2 SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls. All core syscalls are supported and example generated files available in the example-output/ folder. Difference Between SysWhispers 1 and 2 The usage is almost identical to...

CVE-2020-0753-and-CVE-2020-0754

Writeup and POC for CVE-2020-0753, CVE-2020-0754 and six unfixed Window DOS Vulnerabilities Exploit FileSystem race condition bug - analysis of CVE-2020-0753 and CVE-2020-0754 Windows Error Reporting service has fixed 2 Elevation of Privilege bugs in last Patch Tuesday, the two bugs are assigned...

CVE-2024-26229

CVE-2024-26229 Windows CSC service privilege escalation vulnerability. When a program writes more data to a buffer than its capacity, a heap-based buffer overflow occurs, causing excess data to overflow into adjacent memory areas. This overflow can corrupt memory and may allow an attacker to...