
DeadMatter
Offset Independent Credential Extraction Tool

Offset Independent Credential Extraction Tool

Tool for extracting information from newly spawned processes

Stealthy In-Memory Local Password Harvester (SILPH) tool: dump LSA, SAM and DCC2 with indirect syscall

Retrieves the master password from Keepass memory dump, using a hint of bruteforce.

Network forensics writeup + tooling for a TryHackMe DFIR challenge: reverses a hex→Base64→XOR exfiltration chain from PCAP traffic, then recovers a…

Python module for viewing Portable Executable (PE) files in a tree-view using pefile and PyQt5. Can also be used with IDA Pro and Rekall to dump…

Dump TeamViewer ID and password from memory. Works much better than other tools.

Retrieve the master password of a keepass database <= 2.53.1

Educational demonstration of CVE-2023-32784 KeePass master password recovery via memory dump analysis, with step-by-step exploit setup and mitigation…

KeePass Master Password Extraction PoC for Linux

Re-write of original KeePass 2.X Master Password Dumper (CVE-2023-32784) POC in python.

tool to extract passwords from TeamViewer memory using Frida

This tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone is created,…

Extracts KeePass master passwords from memory dumps of unlocked databases, outputting potential characters by position, a passphrase, and a…

Original PoC for CVE-2023-30367

Exploitation and defense-in-depth mitigation strategies for the KeePass memory leakage vulnerability (CVE-2023-32784).

PHP 8.5.11 - Critical - Remote - UAF - CVE-2026-109619 PHP2Shell. Same-worker fatal backtrace then INI diagnostic on Apache mod_php. Lab vs 8.5.12.…