#1Tools for maintaining access, exploring, and expanding control within compromised systems and networks.
Kitploit recommended

A concept of using a ROP chain paired with a WRMSR primitive to call kernel functions and map unsigned drivers through BYOVD (AmdTools64.sys)
Automated 802.1x Bypass

ACEshark is a utility designed for rapid extraction and analysis of Windows service configurations and Access Control Entries, eliminating the need…

Leverage WindowsApp createdump tool to obtain an lsass dump

This tool can be used during internal penetration testing to dump Windows credentials from an already-compromised host. It allows one to dump SYSTEM,…

Bof of RegPwn by MDSec

Low-observability Active Directory security enumeration tool using native ADSI/COM interfaces. Enumerates ACLs, delegation, trusts, ADCS, Kerberoast…

Steganography Tool for JPG Images

Proof-of-concept C exploit that runs a DLL with WinTcb-Light protection from userland, demonstrating a Windows privilege-escalation primitive and…

BOF to steal Teams cookies

Root your Galaxy using CVE-2026-43499

Chisel new generation, written in rust. SSH under WSS with some customization.

Proof-of-concept for arbitrary file delete vulnerability in Cisco Secure Client and AnyConnect, enabling privilege escalation to SYSTEM via Windows…

Multithreaded C# .NET assembly for enumerating local administrative privileges across Windows hosts via SMB, WMI, and WinRM, with BloodHound…

PoC and technical details of CVE-2025-24204

CVE-2019-9729. Transferred from https://github.com/DoubleLabyrinth/SdoKeyCrypt-sys-local-privilege-elevation

CVE-2018-8440 standalone exploit

A simple POC that abuses Backup Operator privileges to remote dump SAM, SYSTEM, and SECURITY