RegPwn

🛠️ RegPwn - Windows ローカルエクスプロイトツール RegPwn は、Windows システム上でローカル権限昇格（LPE）エクスプロイトを実証するために設計されたツールです。Windows 10、Windows 11、および Windows Server バージョンで動作します。このガイドでは、RegPwn を Windows コンピュータに安全かつ効果的にダウンロード、準備、実行する方法を説明します。 📋 始める前に必要なもの RegPwn をダウンロードする前に、システムが次の条件を満たしていることを確認してください: サポートされている Windows...

fingerprint

fingerprint Monitoring Registry and File Changes in Windows - forensic analytics for windows registry and files "fingerprint" records the state of a windows system, in terms of files and registry. Such fingerprints can be compared to find all changed data. The data can be narrowed with procmon...

go-secdump

go-secdump Description Package go-secdump is a tool built to remotely extract hashes from the SAM registry hive as well as LSA secrets and cached hashes from the SECURITY hive without any remote agent and without touching disk. The tool is built on top of the library go-smb and use it to...

mscache

mscache 윈도우 레지스트리에서 dcc도메인 캐시 자격 증명를 조작하는 도구로, 주로 mimikatz와 impacket의 작업을 기반으로 합니다. 요구 사항 python2 pycrypto passlib impacket 예제 root@kitploit: python mscache.py --security security --system system dumping domain cached credentials reg query "HKEYLOCALMACHINE\SECURITY\Cache" /v "NL$1" 2018-08-22...

Reg1c1de

Reg1c1de: Windows Registry Privesc Scanner Summary from help output: Reg1c1de is a tool that scans specified registry hives and reports on any keys where the user has write permissions In addition, if any registry values are found that contain file paths with certain file extensions and they are...

MEC

Masked Extension Control MEC Masked Extension Control MEC は、Windows がファイルを開くプログラムを拡張子だけでなくマジックナンバーに基づいて選択できるようにするプログラムです。これはシステムにとってはるかに安全です。なぜなら、多くの攻撃は拡張子を偽装して、本来ファイルを開くべきプログラムではなく、脆弱なプログラムに開かれたり実行されたりすることを試みることから始まるからです。 開発者モード 詳細については、https://mec.e-paths.com を参照してください。 偽の拡張子に基づく攻撃を防ぐ...

DecryptTeamViewer

DecryptTeamViewer Uses CVE-2019-18988 to enumerate and decrypt TeamViewer credentials from Windows registry. Vulnerability research done by Nic Losby. Blogpost detailing the vulnerability: https://whynotsecurity.com/blog/teamviewer/ Usage .\DecryptTeamViewer.exe...

cve-2017-8529

cve-2017-8529 私のCVE-2017-8529ファイル CVE-2017-8529のレジストリ修正を構成するPowerShellスクリプト。...

CVE-2024-4573-Mitigation-Script

Script di Mitigazione CVE-2024-4573 CVE-2024-43451 è una vulnerabilità nei sistemi che permettono l'autenticazione NTLM, un protocollo legacy che può essere sfruttato per attacchi di relay di credenziali o attacchi di forza bruta. Questa vulnerabilità si presenta quando NTLM è abilitato, lasciand...

LAB-DFIR-cve-2023-38831

LAB-DFIR-cve-2023-38831 Questo lab simula un attacco CVE-2023–38831 e richiede di investigare sull'immagine del disco; contiene inoltre una serie di domande tra cui la comprensione del registro di Windows, dei file NTFS, della cache del browser e una comprensione completa delle funzioni che...

MAL-2026-4348 Malicious code in api-rs-node (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

MAL-2026-4349 Malicious code in clob.api (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

Malicious code in get-package-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 383f22ab2e1e8bbb44a44fa3828710f476947837d0b38aa9266eafcbf9959261 Package name typosquats the popular get-package-type and reuses its README/exports verbatim, but adds "postinstall": "node utils.cjs" in package.json...

Windows Registry Privilege Escalation Scanner / Audit Tool

This PowerShell script is a defensive security auditing tool designed to inspect Windows registry areas commonly associated with privilege escalation EoP techniques and system misconfigurations...

Electron 注入漏洞

Electron is an open-source JavaScript framework developed by users for creating cross-platform desktop applications. This framework is based on Node.js and Chromium, allowing the development of cross-platform desktop applications using HTML and CSS. Versions of Electron prior to 38.8.6, 39.8.1,...

Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

Impact On Windows, app.setAsDefaultProtocolClientprotocol did not validate the protocol name before writing to the registry. Apps that pass untrusted input as the protocol name may allow an attacker to write to arbitrary subkeys under HKCU\Software\Classes, potentially hijacking existing protocol...

Microsoft Windows Registry Editor Version 5.00 Malicious Registry File Generator

This script generates a malicious Windows Registration Entries .reg file designed to establish persistence on Windows systems. It creates a registry file that, when executed by a user, adds the attacker's payload to Windows auto-run registry keys. Written in PHP...

Dust Specter Targets Iraqi Officials with New SPLITDROP and GHOSTFORM Malware

A suspected Iran-nexus threat actor has been attributed to a campaign targeting government officials in Iraq by impersonating the country's Ministry of Foreign Affairs to deliver a set of never-before-seen malware. Zscaler ThreatLabz, which observed the activity in January 2026, is tracking the...

Windows Registry Active Setup Persistence

This Metasploit module will register a payload to run via the Active Setup mechanism in Windows. Active Setup is a Windows feature that runs once per user at login. It triggers in a user context, losing privileges from admin to user...

Windows Registry Run Persistence

This Metasploit module is a Windows persistence module designed to maintain access to a compromised system after a successful exploitation and an active Meterpreter session has been obtained...