BugChecker

BugChecker Introduction BugChecker is a SoftICE-like kernel and user debugger for Windows 11 and Windows XP as well: it supports Windows versions from XP to 11, both x86 and x64. BugChecker doesn't require a second machine to be connected to the system being debugged, like in the case of WinDbg a...

appsandbox

App Sandbox App Sandbox is a virtual machine app for Windows and macOS that's focused on performance and ease of use. Windows features: Works on Windows 11 Home or Pro, without Hyper-V Windows 11 or Ubuntu 26.04 LTS VM Support Zero touch install Copy and Paste 2 Channel Audio GPU Acceleration via...

Nidhogg

Nidhogg Nidhogg is a multi-functional rootkit to showcase the variety of operations that can be done from kernel space. The goal of Nidhogg is to provide an all-in-one and easy-to-use rootkit with multiple helpful functionalities for operations. Besides that, it can also easily be integrated with...

gdid-reversal

Full writeup of the Windows GDID Global Device Identifier fully reverse engineered -8a2be2 -0078d6 How Microsoft's "Global Device Identifier", the persistent Windows fingerprint named in the July 2026 Scattered Spider complaint, is actually generated, stored, and transmitted. TL;DR !NOTE Listed...

UPnPHostFileRead

Description Local arbitrary file read PoC exploit for the Windows UPnP Device Host service. Reads an arbitrary file in the context of LOCAL SERVICE. Tested against Windows 11 Pro build 26200.8457. Reported to Microsoft. Assessed as "not a vulnerability". How to Build 1. Clone the repository. 2...

CVE-2026-45585

🔑 CVE-2026-45585 - YellowKey 🔓 Advanced mitigation for CVE-2026-45585 YellowKey 📌 What is YellowKey Vulnerability? YellowKey CVE-2026-45585 is a zero-day physical attack vulnerability discovered in May 2026 that allows attackers with physical access to completely bypass BitLocker encryption on...

VEN0m-Ransomware

VEN0m Ransomware https://github.com/user-attachments/assets/5a1fc9b5-a647-41f6-a152-7b9d97381adc This project demonstartes how a legit, and signed driver can be weponized to evade defenses and deploy ransomware simulating a real cyberattack. 🚨 Tested on Windows 11 Pro 24H2. Fully undetectable as ...

CVE-2026-40369

🚨 CVE-2026-40369 - Windows Kernel Elevation of Privilege Vulnerability Windows Kernel Heap-Based Buffer Overflow allowing local attackers to elevate privileges toNT AUTHORITY\SYSTEM. 📖 Overview CVE-2026-40369 is a High Severity privilege escalation vulnerability affecting Microsoft Windows Kernel...

w11_shadow_copies

Windows 11 Shadow Copies On Windows 11, the built-in vssadmin can list, delete or resize Shadow Copies, but Microsoft removed the ability to create them. However, you can still do it by interacting directly with the Volume Shadow Copy Service VSS API, which I already used in my other tool SAMDump...

Pentest-Windows

Pentest-Windows11 v3.2 The First Windows Penetration Testing Environment on Mac M Chips 中文文档 | English README 📖 Project Overview 📝 System Introduction This environment aims to provide a ready-to-use Windows penetration testing environment. Reposting is welcome. Please indicate the original author...

CVE-2020-17103

🛡️ MiniPlasma - CVE-2020-17103 A Windows Local Privilege Escalation Zero-Day Turning placeholder files into SYSTEM access 📋 Overview MiniPlasma is a powerful local privilege escalation exploit targeting CVE-2020-17103 in the Windows Cloud Files Mini Filter Driver cldflt.sys. It allows any standard...

TABPE

TABPE What is TABPE? TABPE a combination of TABriz + PE - Tabriz is my hometown, and I named this project after my love for my city is an open, structured dataset containing information about all PE files Windows executables including .exe, .dll, .sys, etc., on clean, fully updated versions of...

RvbbitSafe

RvbbitSafe: The Hacker's Nightmare – A Six-Fortress Anti-Ransomware Architecture for Windows 🛡️ Overview RvbbitSafe is a research prototype demonstrating a paradigm shift in ransomware defense. It's an active, multi-layered fortress that combines hardware virtualization, AI-driven deception,...

CVE-2024-30085

CVE-2024-30085 CVE-2024-30085 Alex Birnberg Affected Versions: Windows 11 23H2 Originally from here Slighly modified to compile with no configuration on visual studio...

CVE-2026-40369-EXPLOIT

Full Blog - https://pwn2nimron.com/blog CVE-2026-40369: Arbitrary Kernel Address Increment via NtQuerySystemInformation Class 253 Summary Type: Arbitrary kernel write increment — PRIVILEGE ESCALATION PRIMITIVE Component: ntoskrnl.exe — ExpGetProcessInformation Trigger:...

CVE-2024-30051

CVE-2024-30051 — Windows DWM Heap Overflow EoP · Master's Thesis Research -orange Heap-based Buffer Overflow in Windows Desktop Window Manager dwmcore.dll Local Privilege Escalation → Integrity Level SYSTEM via DWM process Build target: Windows 11 22H2 10.0.22621.3447 · Patch: KB5037771 Descripti...

CVE-2026-49176_LPE_POC

CVE-2026-49176 SYSTEM Shell PoC Local privilege-escalation proof of concept for the Windows WalletService vulnerability fixed in July 2026. Technical write-up: CVE-2026-49176 Exploit Development: WalletService to SYSTEM. A standard user creates a Wallet ESE database containing a persisted callbac...

CVE-2024-49138-POC

CVE-2024-49138-POC Proof of Concept that exploits CVE-2024-49138 in CLFS.sys. CrowdStrike detected the vulnerability actively exploited by threat actors. Tested on Windows 11 23h2. A thorough analysis is available here. Below the hash of the ntoskrnl.exe and clfs.sys that were used to test the PO...

CVE-2023-38146

PoC for the ThemeBleed CVE-2023-38146 exploit Windows 11 Themes Heavily inspired by https://github.com/gabe-k/themebleed which only runs on windows the reason why i decided to write this. Used modified code from the impacket smbserver.py...

IoRingReadWritePrimitive

IoRingReadWritePrimitive Post exploitation technique to turn arbitrary kernel write / increment into full read/write primitive on Windows 11 22H2+ This PoC is using the HackSysExtremeVulnerableDriver. The PoC supports both arbitrary write and arbitrary increment, controlled through a flag passed...