Credential-Hunting

CredsHunter credshunter is a read-only credential finder for authorized post-exploitation. It walks a host once and surfaces the secrets you can actually reuse — passwords, keys, hashes, and credential files — while staying quiet on the cloud / SaaS tokens that only add noise. Two siblings, one...

FakeNetBIOS

Note to author: if you would like this pulled from Github, I understand and will do so without question. Since you have provided source I @mubix figured it would be a good way to get improvments into the package | | | FakeNetBIOS Tools | | | | Simulation of NetBIOS hosts Windows-like | | |...

pyrexecd

PyRexecd PyRexecd is a standalone SSH server for Windows. Features: Standalone Win32 app not a service that resides in SysTray. Supports a single user / pubkey auth only. Notifies incoming connections via popup. Sends/Receives the clipboard text via stdin/stdout. PyPI Project page:...

Metamorph

Metamorph Introduction This tool is a command-line utility for Windows written in C that creates and configures persistent Event Tracing for Windows ETW AutoLogger sessions. AutoLoggers automatically start tracing specific ETW providers upon system boot, making them useful for capturing events th...

CVE-2023-36900

CVE-2023-36900 About this vulnerability: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36900. Writeup Imhex pattern for .blf extension Header with declaration of CLFS structures Denial-of-Service proof of concept Imhex pattern for blf extension Before: After: The pattern is far...

CFB

What is it? !CAUTION CFB is meant for research and debug purposes, it should never be used on production systems. Also BSoD may happen. You've been warned. Canadian Furious Beaver is a ProcMon-style tool designed only for capturing IRPs sent to any Windows driver. It operates in 2 parts: 1. the...

e013

e013 A little VBScript that steal Wifi passwords from Windows Into the file WifiName.txt you can see the password of every saved wifi available on every windows computer that support VBscript ⚠️ Don't modify the script with notepad, use text editor like GNU Emacs, Vim, Atom, Vscode, Sublime text...

Nim-RunPE

Nim-RunPE A Nim implementation of reflective PE-Loading from memory. The base for this code was taken from RunPE-In-Memory - which I ported to Nim. You'll need to install the following dependencies: nimble install ptrmath winim I did test this with Nim Version 1.6.2 only, so use that version for...

epagneul

epagneul Epagneul is a tool to visualize and investigate windows event logs. Deployment Requires docker and docker-compose to be installed. Installing make Offline deployment On a machine connected to internet, build an offline release: make release This will create a release folder containing...

interactive-binary-structures

Interactive Binary Structures An interactive web-based toolkit designed to bridge the gap between theoretical documentation and practical analysis of binary formats and system memory layouts. Portable Executable PE Format Documentation This tool serves as an interactive visual map of a Windows PE...

badecparams

BADECPARAMS Proof of Concept for CVE-2020-0601. badecparams.py generates an intermediate certificate authority that exploits the vulnerability, then issues Authenticode and TLS certificates. The TLS certificates have Extended Validation in Microsoft Edge and Internet Explorer. httpd.py serves the...

loldrivers-client

LOLDrivers-client The OG, blazingly fast , zero dependencies client for LOLDrivers by MagicSword. Scan your Windows computer for known vulnerable or malicious drivers. Installation Command Line Copy and paste the command below into a PowerShell terminal. This does not require an elevated...

smbghost

SMBGhost Scanner CVE-2020-0796 SMBv3 vulnerability scanner SMBGhost. Detects vulnerable Windows hosts by sending a malformed SMBv3 negotiation packet and checking the response. Usage Single host python3 scanner.py -H 10.0.0.5 Host list python3 scanner.py -l targets.txt Network segment python3...

ms09-050-CVE-2009-3103-exploit

MS09-050 SMBv2 Exploit Wrapper One-liner setup for MS09-050 CVE-2009-3103 exploitation. No fuss, no debugging, just works. Why? Most MS09-050 scripts floating around require manual shellcode injection, have timing issues with handlers, or just don't work. This wrapper: Generates shellcode with...

KTM_POCS

KTMPOCS This repo contains reports for CVE 2024-43570 and CVE 2024-43535, two vulnerabilities I found in the Windows Kernel Transaction Manager driver tm.sys. This repo also contains exploit code I used for the demos in the OffensiveCon25 Presentation: Hunting for Overlooked Cookies in Windows 11...

aDLL

aDLL - Adventure of Dinamic Lynk Library aDLL is a binary analysis tool focused on the automatic discovery of DLL Hijacking vulnerabilities. The tool analyzes the image of the binary loaded in memory to search for DLLs loaded at load-time and makes use of the Microsoft Detours library to intercep...

Tallow

Tallow - Transparent Tor for Windows Tallow is a small program that redirects all outbound traffic from a Windows machine via the Tor anonymity network. Any traffic that cannot be handled by Tor, e.g. UDP, is blocked. Tallow also intercepts and handles DNS requests preventing potential leaks...

CVE-2019-0708

CVE-2019-0708 CVE-2019-0708 Scanner PoC by @JaGoTu and @zerosum0x0. In this repo A scanner fork of rdesktop that can detect if a host is vulnerable to CVE-2019-0708 Microsoft Windows Remote Desktop Services Remote Code Execution vulnerability. It shouldn't cause denial-of-service, but there is no...

cve-2022-21907-http.sys

cve-2022-21907-http.sys by 1vere$k CVE-2022-21907 - Double Free in http.sys driver. Summary An unauthenticated attacker can send an HTTP request with an "Accept-Encoding" HTTP request header triggering a double free in the unknown coding-list inside the HTTP Protocol Stack http.sys to process...

Py-RDP-Patcher

Py-RDP-Patcher Py-RDP-Patcher is a tool made in python to patch the termsrv file to allow simultaneous RDP sessions Setup Guide: This script only requires the art library which is installed by executing : pip install art Requirements: Python3, Windows Limitations: For now this script only support...