CVE-2021-38639

Windows win32k ascension UAC POC Components used:win32kfull.sys、win32kbase.sys、win32k.sys Describe: win32kbase.sys UAF using POC:popup calculator...

CVE-2019-1388

CVE-2019-1388 CVE-2019-1388 Abuse UAC Windows Certificate Dialog Description: This CVE exploit tend to abuse the UAC windows Certificate Dialog to execute the certificate issuer link as an NT Authority User and open a browser that is under NT Authority User. Then we can use that to prompt a shell...

CVE-2026-30332

CVE-2026-30332 Description A Time-of-Check to Time-of-Use TOCTOU vulnerability was identified in Balena Etcher for Windows in versions prior to 2.1.4. The application creates a temporary .cmd file in a user writable directory and later executes it with elevated privileges via UAC. This allows an...

CVE-2019-1388-Privilege-Escalation--2021-

CVE-2019-1388 Privilege Escalation CVE-2019-1388 Lab Analysis: Documented local privilege escalation via Windows UAC certificate dialogs on Windows 7. CVE-2019-1388: Windows UAC Privilege Escalation Lab An educational cybersecurity lab and technical analysis documenting CVE-2019-1388 —a local...

redsnarf

. \ \ | / / / \ | // \ / |\ \ / \ \ \ \ | | \ // // |/ \ | / | | /| | || /\ / /| /| || / / / / / / [email protected] @redsnarf RedSnarf is a pen-testing / red-teaming tool by Ed Williams for retrieving hashes and credentials from Windows workstations, servers and domain controllers...

CVE-2019-1388

CVE-2019-1388 UAC Privilege Escalation nt authority\system 0x01 Demo SERVER ====== Windows 2008r2 7601 link OPENED AS SYSTEM Windows 2012r2 9600 link OPENED AS SYSTEM Windows 2016 14393 link OPENED AS SYSTEM Windows 2019 17763 link NOT opened WORKSTATION =========== Windows 7 SP1 7601 link OPENED...

uac-a-mola

uac-a-mola Installation To install uac-a-mola you have to perform the following actions: 1. Download and install python 2.7.x for Windows taking into account your particular infrastructure, you can find the binaries here: https://www.python.org/downloads/ 2. Add the python path to the path...

blackhat-usa-2022-demos

blackhat-usa-2022-demos Demos for the Blackhat USA 2022 talk "Taking Kerberos to the Next Level". This is the slides and demos for James Forshaw @tiraniddo and Nick Landers @monoxgas presentation. The demos are as follows: demo1.ps1 - Silver ticket with password. demo2.ps1 - Silver ticket U2U...

BypassUAC

README This program is based on whitelist bypassuac. Using CS's AV-bypassing payload, you can directly get a session with UAC privileges. Usage: bypassuac.exe The demo effect is as follows whoami /priv as follows hashdump captures passwords as follows Bypass-AV Effect Windows Defender test passed...

KRBUACBypass

Background This POC is inspired by James Forshaw @tiraniddo shared at BlackHat USA 2022 titled “ Taking Kerberos To The Next Level ” topic, he shared a Demo of abusing Kerberos tickets to achieve UAC bypass. By adding a KERB-AD-RESTRICTION-ENTRY to the service ticket, but filling in a fake...

NorthStarC2

NorthStarC2 is an open-source command and control framework developed for penetration testing and red teaming purposes by Engin Demirbilek. NorthStar C2 Framework consists of two applications, a server-side GUI web application for managing sessions and a client-side stager to communicate with C2...

byeintegrity9-uac

Initial prototype of byeintegrity9 Just for fun, like always...

DccwBypassUAC

DccwBypassUAC This exploit abuses the way "WinSxS" is managed by "dccw.exe" by means of a derivative Leo's Davidson "Bypass UAC" method so as to obtain an administrator shell without prompting for consent. It supports "x86" and "x64" architectures. Moreover, it has been successfully tested on...

SetupHijack

SetupHijack Overview SetupHijack is a security research tool that exploits race conditions and insecure file handling in Windows installer and update processes. It targets scenarios where privileged installers or updaters drop files in %TEMP% or other world-writable locations, allowing an attacke...

Umbrella

Umbrella Dropper Copyright 2017 Umbrella Written by: Alisson Moretto - 4w4k3 Umbrella is a file dropper dedicated to pentest, its download files on target system are execute them without a double execution of exe, only of embed. To compromise the same target again, you need delete this folder on...

upx

ooooo ooo ooooooooo. ooooooo ooooo 888' 8' 888 Y88. 8888 d8' 888 8 888 .d88' Y888..8P 888 8 888ooo88P' 8888' 888 8 888 .8PY888. 88. .8' 888 d8' 888b YbodP' o888o o888o o88888o The Ultimate Packer for eXecutables Copyright c 1996-2026 Markus Oberhumer, Laszlo Molnar & John Reiser...

DLLHijackingScanner

UAC bypass - DLL hijacking Description This is a PoC for bypassing UAC using DLL hijacking and abusing the "Trusted Directories" verification. Summary Generate Header from CSV Arguments Generate the list of vulnerable PE and DLL DLLHijacking.exe Log file Execution Result test.dll Sources Generate...

UAC-bypass

UAC-bypass Please note: It is a Proof of Concept and is not intended for illegal usage! Visit my website: https://winscripting.blog/ Please donate to this Bitcoin address if you find this PoC helpful: 12WN3fHmr5EB2Y5cDbKAgTDYMo5d1b1AUu alt text...

QuickAssist_UAC_Bypass

QuickAssist UAC Bypass Remark: If you search for a UAC bypass with better compatibility ex: Windows server OSes, you can use:TabTip UAC Bypass QuickAssist is an application that was introduced in Windows 10 1809. It is an UIAccess binary that is installed by default and can be abused to bypass UA...

Winpayloads

Winpayloads - Python2.7 Undetectable Windows Payload Generation with extras Running on Python2.7 As usual, Don't upload payloads to any online virus checkers Virus Total Detection - Updated 25/01/2019 - 16/68 Detections...