VulnScan-Pro

⚡ VulnScan Pro A professional cybersecurity vulnerability scanner built with Python 3.13 and PyQt6. Designed for authorised security assessments, educational research, and defensive cybersecurity. ⚠ Legal Notice This tool must only be used on systems you own or have explicit written permission to...

CallStackMasker

CallStackMasker This repository demonstrates a PoC technique for dynamically spoofing call stacks using timers. Prior to our implant sleeping, we can queue up timers to overwrite its call stack with a fake one and then restore the original before resuming execution. Hence, in the same way we can...

HWSyscalls

HWSyscalls Main Contributors Description HWSyscalls is a new method to execute indirect syscalls using 3 main components: Hardware breakpoints and Vectored Exception Handler to control the flow of execution. HalosGate is used to find syscall numbers and addresses. Creating a synthetic trampoline ...

DInvoke

DInvoke Dynamic replacement for PInvoke on Windows. DInvoke contains powerful primitives that may be combined intelligently to dynamically invoke unmanaged code from disk or from memory with careful precision. This may be used for many purposes such as PE parsing, intelligent dynamic API...

windbg_js_scripts

WinDbg JavaScript Scripts Install as a WinDbg gallery Clone the repository git clone https://github.com/hugsy/windbgjsscripts In windbgjsscripts\config.xml, edit the lines Setting Name="LocalCacheRootFolder" to reflect the local path of the repository. In WinDbg, load the config.xml file and save...

CVE-2021-25253

Exploit Title: Trend Micro OfficeScan Client 10.0 - ACL Service LPE Date: 2023/05/04 Exploit Author: msd0pe Vendor Homepage: https://www.trendmicro.com My Github: https://github.com/msd0pe-1 Cliente de Trend Micro OfficeScan: Las versiones icacls "C:\Program Files x86\Trend Micro\OfficeScan Clien...

Driver-hide-file

hide-file choose and hide windows files/path from kernel space using this driver...

Driver-HideKernelThread-IoCancelIrp

Driver-HideKernelThread-IoCancelIrp not my code. only for saving https://bbs.pediy.com/thread-272795.htm Principle Set the thread entry address to IoCancelIrp and the context to the irp you created. Then the thread will call IoCancelIrp. when called, will perform the operation of canlcelling the...

Driver-HWID-btbd-modified

btbd-modified 1 Modified BTBD spoofer that can be manually mapped tested on 1909...

Driver-kaldereta

Kaldereta Unsigned Kernel Mode Driver that does memory modifications Features get process id get base address of an image change protection of a memory region allocate memory region free memory read/write from address read/write from address with offset read from memory to buffer write to memory...

Driver-SoulExtraction

SoulExtraction SoulExtraction is a windows driver library for extracting cert information in windows drivers Compile Visual Studio 2022 & WDK10 llvm-msvc link Credit linux BackEngineerLab https://git.back.engineering/gmh5225/Driver-SoulExtraction Some discussions on UnknownCheats...

blenny

Blenny is a proof-of-concept payload obfuscation tool for Windows which hides executable payload data within the icon of the executable. It is named after the sabre-toothed blenny fish, which mimmicks the behavior and looks of cleaner fish to prey on unsuspecting fish. Why? I can't recall exactly...

PetitPotato

PetitPotato Local privilege escalation via PetitPotam Abusing impersonate privileges. Description PetitPotam uses MS-EFSR Encrypting File System Remote, a protocol used to perform maintenance and management operations on encrypted data stored remotely and accessed over a network. There are a seri...

PPLmedic

PPLmedic This tool implements a Userland exploit chain for injecting arbitrary code into a PPL with the signer type Windows and elevating to the signer type WinTcb. These techniques were originally discussed by James Forshaw a.k.a. @tiraniddo in his blog post Injecting Code into Windows Protected...

Cronos-Rootkit

Cronos Rootkit Cronos is Windows 10/11 x64 ring 0 rootkit. Cronos is able to hide processes, protect and elevate them with token manipulation. Features Hide process Elevate process permissions Protect process Contributions Contributions are welcome...

Black-Angel-Rootkit

Black Angel Rootkit Black Angel is a Windows 11/10 x64 kernel mode rootkit. Rootkit can be loaded with enabled DSE while maintaining its full functionality. Designed for Red Teams. Rootkit Features Rootkit can be loaded with kdmapper to bypass DSE, Black Angel Loader may not be working properly...

BypassCredGuard

BypassCredGuard - Credential Guard Bypass Via Patching Wdigest Memory Background Adam Chester @xpn wrote an article called "Exploring Mimikatz - Part 1 - WDigest" about memory patching to enable UseLogonCredential and make Wdigest cache cleartext credentials intrigued me. The wdigest.dll module...

awesome-windows-domain-hardening

Awesome Windows Domain Hardening A curated list of awesome Security Hardening techniques for Windows. Created by gepeto42 and PaulWebSec but highly inspired from PyroTek3 research! Summary This document summarizes the information related to Pyrotek and Harmj0y's DerbyCon talk called "111 Attackin...

ntdlll-unhooking-collection

This repository does not have a README...

TelemetrySource

TelemetrySource Project created to map functions repsonsible for triggering events from various telemetry sources. Main Mapping Sheet: Event Mapping Google Sheet Currently mapped sources: Sysmon Window Security Events Microsoft-Windows-Security-Auditing Threat Intelligence Events...