mscache

mscache a tool to manipulate dccdomain cached credentials in windows registry, based mainly on the work of mimikatz and impacket requirements python2 pycrypto passlib impacket example root@kitploit: python mscache.py --security security --system system dumping domain cached credentials reg query...

fingerprint

fingerprint Monitoring Registry and File Changes in Windows - forensic analytics for windows registry and files "fingerprint" records the state of a windows system, in terms of files and registry. Such fingerprints can be compared to find all changed data. The data can be narrowed with procmon...

Reg1c1de

Reg1c1de: Windows 注册表权限提升扫描器 摘要（来自帮助输出）： Reg1c1de 是一款扫描指定注册表配置单元并报告用户具有写入权限的所有键的工具。 此外，如果发现任何包含特定文件扩展名的文件路径的注册表值且这些路径可写，这些也会被报告。 更多关于此工具及其使用的信息可以在相关的 github.io 文章中找到：此处 帮助输出： root@kitploit: ++++++++++++++Reg1c1de++++++++++++++++ +author: @deadjakk | http://shell.rip+...

go-secdump

go-secdump Description Package go-secdump is a tool built to remotely extract hashes from the SAM registry hive as well as LSA secrets and cached hashes from the SECURITY hive without any remote agent and without touching disk. The tool is built on top of the library go-smb and use it to...

DecryptTeamViewer

DecryptTeamViewer Uses CVE-2019-18988 to enumerate and decrypt TeamViewer credentials from Windows registry. Vulnerability research done by Nic Losby. Blogpost detailing the vulnerability: https://whynotsecurity.com/blog/teamviewer/ Usage .\DecryptTeamViewer.exe...

MEC

Masked Extension Control MEC Masked Extension Control MEC Masked Extension Control is a program that makes your Windows rely on magic numbers, and not only on extensions, to choose the program that will be used to open the file. This is much safer for your system, since a lot of attacks begin by...

RegPwn

🛠️ RegPwn - Windows Local Exploit Tool RegPwn is a tool designed to demonstrate a local privilege escalation LPE exploit on Windows systems. It works on Windows 10, Windows 11, and Windows Server versions. This guide will help you download, prepare, and run RegPwn on your Windows computer safely...

CVE-2024-4573-Mitigation-Script

CVE-2024-4573-Mitigation-Script CVE-2024-43451 is a vulnerability in systems that allow NTLM authentication, a legacy protocol that can be exploited for credential relay attacks or brute force attacks. This vulnerability arises when NTLM is enabled, leaving systems susceptible to unauthorized...

LAB-DFIR-cve-2023-38831

LAB-DFIR-cve-2023-38831 This lab simulates a CVE-2023–38831 attack and must investigate diskimage and contains a variety of questions including understanding the Windows registry, NTFS files, cache browser, and a complete understanding of the functions that come out of Windows in the sequence of...

cve-2017-8529

cve-2017-8529 My CVE-2017-8529 files A PowerShell script to configure the registry fix in CVE-2017-8529...

CVE-2026-69337

Double free in Windows Registry allows an authorized attacker to elevate privileges over a network...

CVE-2026-69337

A double free vulnerability in the Windows Registry allows an authorized attacker to elevate privileges over a network . The flaw requires low privileges and user interaction , with high attack complexity , but results in high impact to confidentiality, integrity, and availability (CVSS 3.1 score...

EUVD-2026-73222

Double free in Windows Registry allows an authorized attacker to elevate privileges over a network...

Windows Registry Elevation of Privilege Vulnerability

Double free in Windows Registry allows an authorized attacker to elevate privileges over a network...

MAL-2026-4348 Malicious code in api-rs-node (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

MAL-2026-4349 Malicious code in clob.api (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

Malicious code in get-package-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 383f22ab2e1e8bbb44a44fa3828710f476947837d0b38aa9266eafcbf9959261 Package name typosquats the popular get-package-type and reuses its README/exports verbatim, but adds "postinstall": "node utils.cjs" in package.json...

Windows Registry Privilege Escalation Scanner / Audit Tool

This PowerShell script is a defensive security auditing tool designed to inspect Windows registry areas commonly associated with privilege escalation EoP techniques and system misconfigurations...

Electron 注入漏洞

Electron is an open-source JavaScript framework developed by users for creating cross-platform desktop applications. This framework is based on Node.js and Chromium, allowing the development of cross-platform desktop applications using HTML and CSS. Versions of Electron prior to 38.8.6, 39.8.1,...

Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

Impact On Windows, app.setAsDefaultProtocolClientprotocol did not validate the protocol name before writing to the registry. Apps that pass untrusted input as the protocol name may allow an attacker to write to arbitrary subkeys under HKCU\Software\Classes, potentially hijacking existing protocol...