awesome_windows_logical_bugs

awesomewindowslogicalbugs Created this repo for the people who want to learn about windows logical privilege escalation bugs. And also I added some of my findings. You can contact me via @404death to add good article which I missed. work in progress WIP , I'm always update this repo when the new...

TokenUniverse

Token Universe Token Universe es una herramienta avanzada para experimentar e investigar los mecanismos de seguridad de Windows. Expone una interfaz de usuario para crear, visualizar, suplantar y modificar tokens de acceso, generar procesos, gestionar la Autoridad de Seguridad Local, verificar el...

impersonate-rs

IRS Impersonate-RS 💡 IRS is a library version of https://github.com/zblurx/impersonate-rs, zblurx Reimplementation of Defte Impersonate in plain Rust. For more informations about it, see this blogpost. The token impersonation approach is a bit different from Defte Impersonate : here you have to...

Auto-Elevate

Auto-Elevate Esta herramienta demuestra el poder de las evasiones de UAC y las características integradas de Windows. Esta utilidad localiza automáticamente winlogon.exe, roba y suplanta su TOKEN de proceso, y crea un nuevo proceso a nivel SYSTEM con el token robado. Combinado con el método de...

PrintSpoofer-ReflectiveDLL

PrintSpoofer Details PrintSpoofer is a tool that performs local privilege escalation by exploiting a vulnerability in the Windows Print Spooler service CVE-2019-1040 / CVE-2019-1019. This project implements the PrintSpoofer exploit in Reflective DLL format, making it suitable for use with...

RottenPotato

Este código ya no se mantiene - para una implementación más reciente, consulte https://github.com/breenmachine/RottenPotatoNG RottenPotato Escalada de Privilegios Local desde Cuentas de Servicio de Windows a SYSTEM Para una visión técnica de este exploit, consulte nuestra publicación en el blog e...

RemoteRecon

RemoteRecon Reconocimiento remoto y recolección RemoteRecon proporciona la capacidad de ejecutar capacidades de post-explotación contra un host remoto, sin tener que exponer tu conjunto completo de herramientas/agente. A menudo, como operadores, necesitamos comprometer un host solo para poder hac...

RottenPotatoNG

RottenPotatoNG Nueva versión de RottenPotato como DLL en C++ y binario independiente en C++ - sin necesidad de meterpreter ni otras herramientas. RottenPotatoDLL Este proyecto genera un archivo DLL y EXE. La DLL contiene todo el código necesario para realizar el ataque RottenPotato y obtener un...

sandbox-attacksurface-analysis-tools

sandbox-attacksurface-analysis-tools バージョン 2. c Google LLC. 2015 - 2024 James Forshaw によって開発 これは、Windows 上のサンドボックスのさまざまなプロパティをテストするための、小規模な PowerShell ツール群です。多くのツールでは、サンドボックス化されたプロセスの PID を指定するために使用される -ProcessId...

CVE-2020-11493

CVE-2020-11492 Proof-of-Concept PoC for Docker Desktop for Windows privilege escalation vulnerability. This vulnerability was patched in Docker version 2.3.0.2 on May 11th, 2020. This PoC performs the following: creates a named pipe mimicking docker named pipe \.\pipe\dockerLifecycleServer, call...

Masky

Masky Masky es una librería de Python que proporciona una forma alternativa de volcar de forma remota las credenciales de los usuarios del dominio gracias a un ADCS. Se ha construido una herramienta de línea de comandos sobre esta librería para recopilar fácilmente PFX, hashes NT y TGT en un ámbi...

TokenPlayer

TokenPlayer Manipulating and Abusing Windows Access Tokens. TokenPlayer is just a small tool i made to learn win32 api programming and understand better the access token model of windows. Features: Stealing and Impersonating primary tokens. Impersonating Protected Processes. Bypassing UAC by usin...

BackupCreds

BackupCreds root@kitploit: | | | | | | | Dump all the Creds! | | | | | | | | | | | | Lefteris lefty Panos | || Abusing SeTrustedCredmanAccessPrivilege to dump user creds The program provides the ability to dump the stored credentials a user might have in the Windows Credential Manager. It is a...

TokenStealer

TokenStealer A simple tool I wrote some time ago for stealing and playing with Windows tokens. Parts of code have been taken and adatpted from https://github.com/FSecureLABS/incognito Clearly, you will require Impersonation or AssignPrimary privilege and Debug privilege to access all processes...

CVE-2020-11492

CVE-2020-11492 Proof-of-Concept PoC for Docker Desktop for Windows privilege escalation vulnerability. This vulnerability was patched in Docker version 2.3.0.2 on May 11th, 2020. This PoC performs the following: creates a named pipe mimicking docker named pipe \.\pipe\dockerLifecycleServer, call...

CVE-2026-55770

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaputil/client.go GetUserDN. With the LDAP authentication...

CVE-2026-48722 Nextflow: Incorrect default permissions in the nextflow auth login command

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

EUVD-2026-78368

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the privatekeyjwt client authentication path uses ClientJwksResolverCache without reliably binding a cached jwksuri resolver and verified assertion to the expected clientID in ClientCredentialsReader. An attacker...

CVE-2026-90452

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the...

CVE-2026-16745

The CVE-2026-16745 entry concerns odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). The root cause is an incorrect network binding that allows a malicious actor inside the cluster to bypass authentication and impersonate any user by presenting an arbitrary access token. Th...