r41n3rzuf477/quickassist_uac_bypassUAC bypass PoC abusing the UIAccess QuickAssist binary to load an attacker-controlled DLL via WebView2 BrowserExecutableFolder, then hijack elevated…
monoxgas/srdiShellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode
weedhashpeddler/rc4decryptionAbuses the Microsoft-signed tlscsp.dll LOLBin to run RC4 encrypt/decrypt via LsCsp_EncryptHwid, patching the hardcoded key in memory for BYOK…
bhassani/eternalbluecEternalBlue suite remade in C/C++ which includes: MS17-010 Exploit, EternalBlue vulnerability detector, DoublePulsar detector and DoublePulsar…
hagrid29/duplicatedumpDumping LSASS with a duplicated handle from custom LSA plugin
med0x2e/sigflipSigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.
dmitry-matvienko/malware-analysis-fake-hwmonitorTechnical analysis, writeup, and YARA rules for a DLL Sideloading campaign disguised as HWMonitor
strivexjun/memorymoduleppC++ library to load DLLs directly from memory without touching disk, with exception handling support, enabling stealthy code execution and evasion of…
0xrootpls/fritterPolymorphic shellcode generator for in-memory execution of EXE, DLL, .NET, VBScript, and JScript with per-output and per-build randomization for…
vollragm/ghostdebugDebugger utilizing stealth hooks to hide from debugger detection
1neptune/chimeraRust-based DLL hijacking loader for MobaXterm (CVE-2026-6421) with persistence
rat5ak/cve-2026-50343-installservice-eopCVE-2026-50343 InstallService StaticPluginMap EoP - standard user to SYSTEM
riftsandroses/cve-2024-50986An issue in Clementine v.1.3.1 allows a local attacker to execute arbitrary code via a crafted DLL file (DLL Hijacking)
sailay1996/cdpsvclpeWindows Local Privilege Escalation via CdpSvc service (Writeable SYSTEM path Dll Hijacking)
vu-ls/crassusWindows privilege escalation discovery tool that parses Process Monitor boot logs to identify DLL hijacking, weak ACLs, and other elevation paths,…
microsoft/detoursRuntime Windows API interception library for hooking, monitoring, and instrumenting function calls. Supports binary rewriting and DLL injection,…
knight0x07/impulsivedllhijackC# based tool which automates the process of discovering and exploiting DLL Hijacks in target binaries. The Hijacked paths discovered can later be…
kasturixbm5/staged-dll-injection-smb-Staged DLL injection proof-of-concept built in C using Win32 APIs — developed in an isolated lab environment for red team certification study (CRTO).
