Invoke-RunAsWithCert

Invoke-RunAsWithCert A PowerShell script to perform PKINIT authentication with the Windows API from a non domain-joined machine. Description This cmdlet creates a new logon session with the specified certificate via PKINIT. It is meant to be run on a non domain-joined VM. The cmdlet has two modes...

FUCKER

FUCKER Windows-native penetration testing framework written in Go. Modular architecture with AI-driven decision engine OpenAI-compatible API. Build go build -ldflags="-X main.version=$git describe --tags" -o FUCKER.exe ./cmd/fucker/ Cross-compile: GOOS=linux GOARCH=amd64 go build -o...

CVE-2026-20841

CVE-2026-20841 PoC PoC of the "Windows Notepad RCE" vulnerability. Disclaimers 1. I am NOT the one who discovered this vulnerability. Props to the original authors listed on the official disclosure page. I just recreated the PoC according to the description. 2. I personally don't think this...

Hijack-service-binaries

Hijack-service-binaries A PowerShell security auditing tool that identifies Windows service binaries that can be modified by the current user—a potential privilege escalation vector. Overview This script scans all Windows services except system32 and svchost and checks if the current user has...

BrokenType

BrokenType BrokenType is a set of tools designed to test the robustness and security of font rasterization software, especially codebases prone to memory corruption issues written in C/C++ and similar languages. It consists of the following components: TrueType program generator - a Python script...

Flowise-CVE-2026-58057-exploit

Flowise CVE-2026-58057 - Windows Remote Code Execution Exploit -orange?style=for-the-badg...

CVE-2019-1388-Privilege-Escalation--2021-

CVE-2019-1388 Privilege Escalation CVE-2019-1388 Lab Analysis: Documented local privilege escalation via Windows UAC certificate dialogs on Windows 7. CVE-2019-1388: Windows UAC Privilege Escalation Lab An educational cybersecurity lab and technical analysis documenting CVE-2019-1388 —a local...

CVE-2026-20169

IoT-FND Overview Features Network Discovery The scanner checks a defined IP range and looks for devices exposing the expected management service. Example checks: IP range enumeration TCP port availability testing Service discovery Basic connection validation Windows Native Implementation Built...

0net

0net: Simple Windows Remote Control Backdoor Introduction: 0net is a simple Windows remote control backdoor program. The client is written in C++ and compiled with VC++6.0. The server is written in Python and is cross-platform. The project is currently under development... Project details:...

ZeroRAT

ZeroRAT Introduction A remote control tool for Windows. The client only needs to execute a single command, utilizing native Windows programs for execution without writing files to disk, providing inherent AV evasion. It becomes ineffective after reboot. In the program, download and upload are fro...

cve-2024-26229

cve-2024-26229 A nim version of the now outdated Windows LPE vulnerability abusing CSC. This is for educational purposes only, and refer to the patch list to determine whether or not your system/your target is vulnerable. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26229 Usage...

nessus-vulnerability-scanning-lab

Nessus Vulnerability Scanning Lab — Azure Full vulnerability management lifecycle — scan, find, fix, verify — executed against my live Azure Active Directory lab environment using a dedicated, Terraform-deployed Nessus scanner. What This Lab Demonstrates I deployed a dedicated Ubuntu 24.04 scanne...

cve-2022-30190

cve-2022-30190 CVE-2022-30190 remediation via removal of ms-msdt from Windows registry Resources Microsoft Guidance and Workaround Palo Alto Assessment...

CVE-2013-3900-WinTrustVerify

Windows-Cert-Padding-Check...

CVE-2023-21768-POC

CVE-2023-21768-POC CVE-2023-21768 Windows 11 22H2 Local Privilege Escalation POC Usage: WindowsAFDLPECVE-2023-21768.exe Where is the process ID decimal to elevate, causing the target process to be elevated to SYSTEM privileges...

Exploit_MS08-067

Complete Usage Guide: Exploit MS08-067 Enhanced 📌 Basic Usage python3 ExploitMS08-067.py OPTIONS 🎯 Practical Examples 1. Windows XP SP0/SP1 Default Port 445 python3 ExploitMS08-067.py 192.168.1.100 1 2. Windows 2003 SP1 English Port 139 python3 ExploitMS08-067.py 192.168.1.150 4 -p 139 3. With...

Windows-exploitation-BadBlue-2.7-CVE-2007-6377

This repository does not have a README...

Etern-blue-Windows-7-Checker

Eternalblue SMB1 Windows7/10 checker Updated and now detects Windows 7 and as well as old version Windows 10 that supports SMB 1. I only implemented smb 1 and any smb 2 server you try this on will return a "not vulnerabile". I researched on how the structure of a SMB1 packet and how to constructe...

CVE-2020-14882

CVE-2020-14882 CVE-2020-14882/14883/14750 USE 1. clone this repo 2. install requests lib 3. python3 14882.py E.G λ python3 14882.py -u http://...:7001 -c whoami + Command success result: win-t63ko18er74\administrator reference https://github.com/jas502n/CVE-2020-14882...

CVE-2024-1874

CVE-2024-1874 Proof Of Concept for CVE-2024-1874 Command Injection via Array-ish $command Parameter of procopen bypass CVE-2024-1874 fix The CVE: In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailin...