593 matches found
fingerprint
fingerprint Monitoring Registry and File Changes in Windows - forensic analytics for windows registry and files "fingerprint" records the state of a windows system, in terms of files and registry. Such fingerprints can be compared to find all changed data. The data can be narrowed with procmon...
RegPwn
🛠️ RegPwn - Windows Local Exploit Tool RegPwn is a tool designed to demonstrate a local privilege escalation LPE exploit on Windows systems. It works on Windows 10, Windows 11, and Windows Server versions. This guide will help you download, prepare, and run RegPwn on your Windows computer safely...
mscache
mscache a tool to manipulate dccdomain cached credentials in windows registry, based mainly on the work of mimikatz and impacket requirements python2 pycrypto passlib impacket example python mscache.py --security security --system system dumping domain cached credentials reg query...
Reg1c1de
Reg1c1de: Windows Registry Privesc Scanner Summary from help output: Reg1c1de is a tool that scans specified registry hives and reports on any keys where the user has write permissions In addition, if any registry values are found that contain file paths with certain file extensions and they are...
DecryptTeamViewer
DecryptTeamViewer Uses CVE-2019-18988 to enumerate and decrypt TeamViewer credentials from Windows registry. Vulnerability research done by Nic Losby. Blogpost detailing the vulnerability: https://whynotsecurity.com/blog/teamviewer/ Usage .\DecryptTeamViewer.exe...
LAB-DFIR-cve-2023-38831
LAB-DFIR-cve-2023-38831 This lab simulates a CVE-2023–38831 attack and must investigate diskimage and contains a variety of questions including understanding the Windows registry, NTFS files, cache browser, and a complete understanding of the functions that come out of Windows in the sequence of...
go-secdump
go-secdump Description Package go-secdump is a tool built to remotely extract hashes from the SAM registry hive as well as LSA secrets and cached hashes from the SECURITY hive without any remote agent and without touching disk. The tool is built on top of the library go-smb and use it to...
MEC
Masked Extension Control MEC Masked Extension Control MEC Masked Extension Control is a program that makes your Windows rely on magic numbers, and not only on extensions, to choose the program that will be used to open the file. This is much safer for your system, since a lot of attacks begin by...
CVE-2024-4573-Mitigation-Script
CVE-2024-4573-Mitigation-Script CVE-2024-43451 is a vulnerability in systems that allow NTLM authentication, a legacy protocol that can be exploited for credential relay attacks or brute force attacks. This vulnerability arises when NTLM is enabled, leaving systems susceptible to unauthorized...
cve-2017-8529
cve-2017-8529 My CVE-2017-8529 files A PowerShell script to configure the registry fix in CVE-2017-8529...
CentOS Linux 6 [TuxCare] Security Update: libsmbclient / libsmbclient-devel / samba / samba-client / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1779902912)
The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1779902912 advisory. - A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply ...
CVE-2026-92680
Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target use...
EUVD-2026-85933
Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target use...
CVE-2026-92680 Araxis Merge insufficiently protected credentials
Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target use...
Araxis Merge
RISK EVALUATION Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative user could retrieve and unencrypt other users'...
PT-2026-97871
Name of the Vulnerable Software and Affected Versions Araxis Merge for Windows versions 2011.4074 through 2026.0 Description The software stores user-configured credentials for remote servers in the Windows registry without applying sufficient cryptographic protection. This allows an authenticate...
CVE-2026-92680: Insufficiently Protected Credentials
Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target use...
Load UCS Data
Load UCS Data %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid346750; scriptversion"1.2"; scriptsetattributeattribute:"pluginmodificationdate", value:"2026/09/17"; scriptnameenglish:"Load UCS Data"; scriptsetattributeattribute:"synopsis", value:"Load UCS Data";...
Malicious code in rojo-rbx (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bf25c0dd3a1b933c3ee2fe887301590c3b92e383a1e6c380fcdb9544578720b The package impersonates the legitimate Rojo Roblox tooling project. Its npm install lifecycle runs scripts/install.js, which on Windows downloads a...