CallstackSpoofingPOC

Callstack spoofing + Indirect Syscalls POC This project consists of a simple C++ self-Injecting dropper focused on EDR evasion POC. To implement it, I have combined the use of Windows Thread Pooling to hide the call stack and the use of indirect syscalls to avoid hooking in the NTDLL...

BiBi-Windows-Wiper-Analysis

Technical Analysis of BiBi-Windows Wiper Targeting Israeli Organizations On 30th October, Security Joes Incident Response team discovered a new Linux Wiper named "BiBi-Linux" Wiper been deployed by Pro-Hamas Hacktivist group to destroy their infrastructure. And then on November 1 2023, ESET...

TokenStealer

TokenStealer A simple tool I wrote some time ago for stealing and playing with Windows tokens. Parts of code have been taken and adatpted from https://github.com/FSecureLABS/incognito Clearly, you will require Impersonation or AssignPrimary privilege and Debug privilege to access all processes...

LdrLockLiberator

LdrLockLiberator DLLMain 이 유일한 방법일 때를 위한 LdrLockLiberator는 DllMain 또는 잠금이 존재할 수 있는 다른 곳에서 코드를 실행할 때 Loader Lock을 벗어나거나 우회하기 위한 기법 모음입니다. 이는 "Perfect DLL Hijacking" 문서와 함께 공개되었습니다. 우리는 여러분께 라이브러리 로더의 잠금을 해제하고 여러분 자신의 컴퓨터에서 로더로 원하는 대로 할 수 있는 열쇠 를 제공합니다! 이 기법들은 가능한 한 범용적이고, 깨끗하며, 100% 안전 하도록 설계되었습니다...

Pentest-Command

项目背景 在渗透测试过程中我们会使用到各类的框架，例如:MSF、CS、Empire、Impacket等，本项目的主要目的是收录在后渗透测试阶段中常用到的命令 基础知识 Windows目录介绍 a、开机启动程序目录c C:\Users\Al1ex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup b、开机自启动程序该特色常被用于进行权限维持c C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup c. System installation path...

MysqlHoneypot

Introduction MysqlHoneypot is a Mysql honeypot project, which mainly uses load data local infile to obtain the user name of the attacker's host Windows platform, and further obtains the WeChat ID according to the user name, and then obtains the user's mobile phone number, login address and other...

MSDT_CVE-2022-30190

MSDTCVE-2022-30190 このリポジトリは、Defenderの視点からFollina MSDTについて解説しています。 目次 概要 タイムライン エクスプロイトの理解 IOCリスト 検出戦略 テストと調査 緩和策 参照 概要 このバグは、Shadow Chaser Group の crazyman によって報告された、Microsoft Windows サポート診断ツール MSDT のリモートコード実行 RCE 脆弱性です。Microsoft は現在これを CVE-2022-30190 として追跡しています。この欠陥は、セキュリティ更新プログラムが提供されているすべての...

MS17-010

MS17-010 This repository is for public my work on MS17-010. I have no plan to do any support. All support issues will not get response from me. Files BUG.txt MS17-010 bug detail and some analysis checker.py Script for finding accessible named pipe eternalblueexploit7.py Eternalblue exploit for...

MAL-002

MAL-002: Force System Restart via Installed Windows MSIs Once a software is successfully installed on the system, one or more trusted MSI files will appear in the “C:\Windows\Installer” folder and may allow a low privilege user to perform “repair” and/or “modify” actions as the “NT...

PSTrojanFile

PSTrojanFile Windows PowerShell Filename and Defender Anti-Malware API - Code Execution POC Discovery: John Page aka hyp3rlinx 2019 and revisted 2023 Updated Dec 24, 2023 Bypassing single quotes obstacle in PowerShell for code exec and bonus PS Windows Event log fail! Semicolon and friend "&"...

msiscan

MSI Analyzer This Python script for Linux can analyze Microsoft Windows .msi Installer files and point out potential vulnerabilites. It was developed by Michael Baer @derbaer0 in the SEC Consult Vulnerability Lab. Currently, it is mostly suited for a local privilege escalation also described in o...

mindmanager-poc

mindmanager-poc Affected application: MindManager23setup.exe Platform: Windows Issue: Local Privilege Escalation via MSI installer Repair Mode EXE hijacking race condition Discovered and reported by: Pawel Karwowski and Julian Horoszkiewicz Eviden Red Team Proposed mitigation:...

DEMO-Proof-of-Concept-Temporal-Memory-Inconsistency-in-cldflt.sys-CVE-2025-62221

Technical Analysis and Proof-of-Concept: Temporal Memory Inconsistency in cldflt.sys CVE-2025-62221 DEMO Proof-of-Concept: Temporal Memory Inconsistency in cldflt.sys CVE-2025-62221 CVE-2025-62221: This repository provides a comprehensive technical analysis and a Proof-of-Concept PoC demonstratio...

symboliclink-testing-tools

symboliclink-testing-tools c Google Inc. 2015 개발: James Forshaw 이 도구 모음은 Windows의 다양한 심볼릭 링크 유형을 테스트하기 위한 작은 도구 모음입니다. 다음 도구들로 구성되어 있습니다: BaitAndSwitch : 심볼릭 링크를 만들고 OPLOCK을 사용하여 TOCTOU에서 승리합니다. CreateDosDeviceSymlink: csrss를 사용하여 개체 관리자 심볼릭 링크를 만듭니다. CreateMountPoint: 임의의 파일 마운트 지점을 만듭니다...

mimikatz

mimikatz mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. .. mimikatz 2....

CVE-2020-1472

Windows NetLogon Privilege Escalation Vulnerability Reproduction CVE-2020-1472 You need to extract impacket.zip to the current folder The latest impacket package can be downloaded here: https://github.com/SecureAuthCorp/impacket For the specific process, please refer to the article:...

invoker

Invoker Utilidad de pruebas de penetración y herramienta de evaluación antivirus. Construido con Visual Studio Community 2022 v17.5.4 64 bits y probado en Windows 10 Enterprise OS 64 bits. Hecho con fines educativos. ¡Espero que sea de ayuda! Este repositorio comenzó a tener firmas conocidas y no...

invoker

Invoker Penetration testing utility and antivirus assessment tool. Built with Visual Studio Community 2022 v17.5.4 64-bit and tested on Windows 10 Enterprise OS 64-bit. Made for educational purposes. I hope it will help! This repository started to have known signatures and I don't have time to...

pickl3

Pickl3 Pickl3 es una herramienta de phishing de credenciales de usuario activo de Windows. Puedes ejecutar Pickl3 y realizar phishing de la credencial del usuario objetivo. Uso Operativo - 1 Hoy en día, dado que el sistema operativo de muchos usuarios finales es Windows 10, no podemos robar...

pickl3

Pickl3 Pickl3 is Windows active user credential phishing tool. You can execute the Pickl3 and phish the target user credential. Operational Usage - 1 Nowadays, since the operating system of many end users is Windows 10, we cannot easily steal account information with Mimikatz-like projects like t...