PPLcontrol
itm4n/pplcontrolWindows tool to list, get, set, protect, and unprotect process protection levels (PP/L) for debugging, inspection, and privilege escalation.
defensive-toolsexploitationprivilege-escalation+1
407
itm4n/pplcontrolWindows tool to list, get, set, protect, and unprotect process protection levels (PP/L) for debugging, inspection, and privilege escalation.
ayub0x7/cve-2024-32019-pocChecks Netdata ndsudo SUID PATH privilege escalation exposure for CVE-2024-32019 and validates patches without weaponized exploitation.
corelight/zerologonZeek package to detect Zerologon
wavestone-cdt/edrsandblastWeaponizes vulnerable signed drivers to bypass EDR kernel callbacks, object callbacks, ETW TI provider, and userland hooks for LSASS memory dumping…
sektioneins/suidguardSUIDGuard - a TrustedBSD Kernel Extension that adds mitigations to protect SUID/SGID processes a bit more
flangvik/sharpapplockerC# port of the Get-AppLockerPolicy PS cmdlet
mein-0/forti-researchProof-of-concept exploiting a Fortinet fortimon3_74.sys kernel driver flaw to bypass PPL and terminate protected processes like lsass.exe via an…
coactionbrittlemaidenhair51/cve-2026-42978-poc-researchExploit and analyze CVE-2026-42978 with a Windows Push Notifications module for AI security, multi-protocol terminal, and autonomous agent suite.
cwjchoi01/cve-2026-31321Proof-of-concept demonstrating methods to disable or bypass Windows Defender by hiding, locking, or protecting its folders, enabling persistence…
millikanjohnl-blip/dirtyfrag-detection-rulesDetection rules and analysis for Dirty Frag (CVE-2026-43284/CVE-2026-43500) Linux kernel LPE vulnerability. Based on community research and health…
phantomiman/7-zip.chm-mitigation7-Zip CVE-2022-29072 Mitigation - CHM file - This script detects if the .chm file exists and removes it.
dropzsec/spliceprivillegeescalationfixthis little script blocks the new splice-ram-privlilleg ecalation fastly befor the contributers do it ( CVE-2026-31431) (CopyFail fix)
0xc4rc3l/cve-2026-34990-pocPython PoC reproducing the CUPS 2.4.16 local-printer flaw: captures the Local auth token via a rogue IPP endpoint, creates a file:// printer, and…
mindcrypt/powerglotPowerglot encodes offensive powershell scripts using polyglots . Offensive security tool useful for stego-malware, privilege escalation, lateral…
hardenedvault/ved-ebpfeBPF-based runtime kernel security monitor detecting exploits and rootkits via control flow integrity (wCFI) and privilege escalation detection (PSD)…
telefonica/uac-a-molaModular framework for Windows UAC bypass attacks and mitigation, featuring DLL hijacking, fileless execution, and real-time monitoring to detect and…
ekitji/siemCurated SIEM queries and techniques for offensive discovery of Windows privilege escalation, misconfigured ACLs, services, scheduled tasks, and…
wgnet/wg.copyfail.patcheBPF-based workaround for CVE-2026-31431 (Copy.Fail) that filters or kills AF_ALG socket creation to prevent local privilege escalation and container…