OffensiveDriver
gmh5225/offensivedriverWindows kernel driver prototype that toggles process protection, adjusts process privileges, patches DSE policy, and manipulates AV/EDR kernel…
defensive-toolsexploitationids-ips-evasion+5
1
gmh5225/offensivedriverWindows kernel driver prototype that toggles process protection, adjusts process privileges, patches DSE policy, and manipulates AV/EDR kernel…
pepsipu/ns2jbConsole jailbreak demo that executes native functions inside the Switch 2 filesystem process via SmileBASIC, verifies results, and restores original…
mein-0/knockgigaProof-of-concept local privilege escalation exploiting Gigabyte gdrv3.sys IOCTLs to write the SYSTEM token into a user process via an unchecked…
hfiref0x/kduWindows kernel driver utility that abuses vulnerable signed drivers (BYOVD) to bypass DSE, load unsigned drivers, hijack protected processes, and…
fabianch20/soc335---cve-2024-49138-exploitation-detectedSOC335 incident response walkthrough for CVE-2024-49138 CLFS privilege escalation, covering alert triage, threat intel enrichment, process tree…
r41n3rzuf477/ps-ppl-bypassProcess Explorer vulnerable driver PPL Bypass
gianlucaborello/libprocesshiderLD_PRELOAD shared library that hides a Linux process from tools like ps and lsof by intercepting readdir and proc filesystem calls.
0x574r/darkcloakLinux process identity cloaking tool that spoofs comm, argv, cmdline, environ, exe path, and VMAs via an 11-phase prctl pipeline to impersonate…
mgiftson0/linux-env-vars-shellshock-labtechnical research & analysis on linux process execution, SUID privilege escalation, LD_PRELOAD hooking, and CVE-2014-6271 (shellshock).
pwardle/not-a-musedProof-of-concept exploiting an undocumented Muse dictation endpoint setting, letting a local unprivileged process redirect dictation traffic to…
gmh5225/dsark64BYOVD proof-of-concept abusing the WHQL-signed DsArk64.sys driver for ring-0 process termination and kernel read/write via encrypted IOCTLs and…
r3vpwnx/cve-2025-8110Proof-of-concept exploit for CVE-2025-8110 in Gogs <=0.13.x, enabling authenticated symlink bypass to arbitrary file write as the Gogs process user,…
deathshotxd/0xm0ncrushKernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.
kaandemir993/lumma-stealer-dllhost-hollowing-c2-domains-payload-extraction-analysisIn-depth reverse engineering analysis of Lumma Stealer, an info-stealer using process hollowing, Native API calls, and C2 communication. Includes…
gmh5225/crippleWindows kernel driver that removes Process Protection (PP) and Process Protection Light (PPL).
kagurazakasanae/mhyprot2drvcontrolA lib that allows using mhyprot2 driver for enum process modules, r/w process memory and kill process.
kkent030315/evil-mhyprot-cliA PoC for Mhyprot2.sys vulnerable driver that allowing read/write memory in kernel/user via unprivileged user process.
sneakynachos/cve-2026-4692-trust-me-im-in-rdmProof-of-concept exploit for Firefox BrowsingContext authorization bypass (CVE-2026-4692), demonstrating forged IPC messages to set InRDMPane and…