Tools for maintaining access, exploring, and expanding control within compromised systems and networks.
wattocyber/offensive-one-liners110 offensive security one-liners for authorized testing and CTFs, organized in one markdown notebook by category and kill-chain step. Dual-use…
kaandemir993/dropper-gcleaner-c2-infrastructure-kernel-driver-powershell-conhost-payload-analysisReverse engineering analysis of Dropper GCleaner, a malware that uses a resilient C2 infrastructure, kernel driver loading, PowerShell/Conhost…
indoushka/context-aware-offensive-intelligenceResearch framework redefining post-exploitation through decision intelligence.
squidsec/bloodbashOffline AD/Entra attack-path analyzer for SharpHound/AzureHound JSON. Surfaces prioritized privilege escalation, credential, and misconfiguration…
paradigmxyz/iron-proxyAn egress firewall for untrusted workloads.
godliveanton/cve-2026-61241Oracle OID LDAP Server Privileges Management Exploit
lanicer/cve-2026-41940-pocExploits cPanel/WHM CVE-2026-41940 authentication bypass via CRLF session injection for unauthenticated root-level WHM access, then lists accounts,…
0xbinder/cve_2019_2215Proof-of-concept LPE exploit for Android Binder UAF that uses iovec spraying and addr_limit overwrite to achieve arbitrary kernel read/write.
deadexpl0it/cve-2026-19598-pocProof of Concept for CVE-2026-19598 affecting Pods <= 3.3.9.
reaizuguo/vivo_iqoo_neo_9_root_research_on_cve-2025-21479iQOO Neo9 (PD2338C) 免解锁 Caps-Root 工具** — 基于 CVE-2025-21479 (Adreno GPU SDS) 的任意物理写提权方案
xiaobailovesstirring/ghostlock-customGhostLock (CVE-2026-43499) adaptation for non-Android Linux 6.x ARM64
hackspeak/cve-2026-53365Local privilege escalation exploit targeting a Linux kernel io_uring AF_VSOCK reference-count bug, using page-cache manipulation to overwrite…
trandonga3/poc-cve-2026-63030-cve-2026-60137-Exploit chain for WordPress Core using REST API route-confusion and SQL injection for unauthenticated RCE, privilege escalation, and full server…
xrzcc/s26-m1q-ghostlock-selinuxGhostLock CVE-2026-43499 research for Galaxy S26 (SM-S942U1/m1q): SELinux Permissive achieved, KASLR + tracefs port, uid=0 boundary documented
mobilehackinglab/ghostlock-a17Kernel exploit for CVE-2026-43499 on Samsung Galaxy A17 achieving root via KDP bypass, KASLR recovery, and forged workqueue execution with persistent…
zychen027/cve-2026-43499_hw-clt-al01Generates per-device kernel offsets from boot.img and compiles a preload library to exploit CVE-2026-43499 Android arm64 local privilege escalation.
cenobyte-vincit/xspawnSpawns macOS programs through launchd's private XPC interface without execing them, making EDR record launchd as parent. Supports one-shot,…
cenobyte-vincit/slot2UEFI GRUB2 bootkit that installs a pre-boot networked implant via NVRAM boot option, chainloads a UKI, executes a dracut payload, and kexecs the…
