Post-Exploitation

exodusintel/cve-2019-0808

Win32k Exploit by Grant Willcox

vozec/cve-2026-41651

Exploits a TOCTOU race in PackageKit's transaction handler to install arbitrary packages as root, achieving local privilege escalation and a SUID…

tyranid/exploitdotnetdcom

A tool to exploit .NET DCOM for EoP and RCE. Is fixed in latest versions of the .NET.

sec-consult/msiscan

Scanning tool for identifying local privilege escalation issues in vulnerable MSI installers

dmcxblue/sharpblackout

Terminate AV/EDR leveraging BYOVD attack

markakd/cve-2021-4154

CVE-2021-4154 exploit

codextf2/cobaltstrike-headless

Aggressorscript that turns the headless aggressor client into a (mostly) functional cobalt strike client.

ricardojoserf/adduser-samr

Create local administrators in Windows using the SAMR API. In C#, Crystal, Python, Rust, Golang, Nim and Deno (Javascript)

twistlock/whoc

A container image that exfiltrates the underlying container runtime to a remote server

mstxq17/cve-2020-1472

cve-2020-1472 复现利用及其exp

h3xduck/umbra

A LKM rootkit targeting 4.x and 5.x kernel versions which opens a backdoor that can spawn a reverse shell to a remote host, launch malware and more.

stphivos/rat-shell

Windows Remote Access Trojan (RAT)

reedgraff/hingesdk

Hinge Dating App SDK for python for lonely bored SWEs

dinosn/mariadb-13-rce-lab

MariaDB 13.0.1-rc RCE lab — priv-esc + heap UAF + JOP chain to system() as uid 999(mysql) on stock Docker image. Found with RAPTOR and…

0xeb-bp/cve-2020-1054

Rust implementation of a Windows 7 x64 local privilege escalation exploit for CVE-2020-1054; compiles via Cargo and executes to elevate privileges.

fortra/cve-2024-6769

Technical writeup and PoC for CVE-2024-6769, chaining DLL hijacking with activation cache poisoning to escalate from medium to high integrity on…