cylancevulnresearch/reflectivedllrefresherReflective DLL that scans process memory and unhooks loaded libraries to evade security software, with UPX, TLS injector, and Meterpreter integration.
r41n3rzuf477/quickassist_uac_bypassUAC bypass PoC abusing the UIAccess QuickAssist binary to load an attacker-controlled DLL via WebView2 BrowserExecutableFolder, then hijack elevated…
gmh5225/iat-hookC++ DLL that performs Import Address Table hooking by parsing PE headers and redirecting imported function addresses to a custom hook inside a target…
weedhashpeddler/rc4decryptionAbuses the Microsoft-signed tlscsp.dll LOLBin to run RC4 encrypt/decrypt via LsCsp_EncryptHwid, patching the hardcoded key in memory for BYOK…
strivexjun/memorymoduleppC++ library to load DLLs directly from memory without touching disk, with exception handling support, enabling stealthy code execution and evasion of…
stephenfewer/reflectivedllinjectionReflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a…
gmh5225/cs-dropspawn_bofCobaltStrike BOF to spawn Beacons using DLL Application Directory Hijacking
withsecurelabs/doublepulsar-usermode-injectorA utility to use the usermode shellcode from the DOUBLEPULSAR payload to reflectively load an arbitrary DLL into another process, for use in testing…
andrewtrube/cve-2021-1675Local privilege escalation exploit for CVE-2021-1675 (PrintNightmare) that installs a malicious DLL to gain SYSTEM access on vulnerable Windows…
0xc4r/cve-2026-21508_pocProof-of-concept for CVE-2026-21508, demonstrating a DLL hijacking attack on Windows 11 that escalates privileges by loading a crafted DLL into…
s3c/globalprotect-ca-cert-ipcProof-of-concept exploit for CVE-2025-0117 in GlobalProtect, achieving privilege escalation to SYSTEM via a backdoored installer and DLL injection.
omribaso/sccm-cve-2026-47301-remote-code-execution-exploitProof-of-concept exploit chain (CVE-2026-47301) for Microsoft Configuration Manager (SCCM), combining a broken access, CAB arbitrary-write path…
phackt/wptsextensions.dllWptsExtensions.dll for exploiting DLL hijacking of the task scheduler.
sailay1996/cdpsvclpeWindows Local Privilege Escalation via CdpSvc service (Writeable SYSTEM path Dll Hijacking)
hackerhouse-opensource/iscsicpl_bypassuacUAC bypass for x64 Windows 7 - 11
choisg/onedriveupdatersideloadingPayload for DLL sideloading of the OneDriveUpdater.exe, based on the PaloAltoNetwork Unit42's blog post
iilegacyyii/exportdumperA small tool I made to dump the export table of PE files. The primary use case was intended for use within DLL proxying.
playboisk8/poc-cve-2017-8464-opencalculatorExploiting the .lnk vulnerability and operating system handling mechanisms regarding explorer.exe and USB drives.
