Tools

duyduongduyduong/cve-2021-36934-dll-hijacking-dfir-investigation

DFIR investigation resources for CVE-2021-36934, covering DLL hijacking, privilege-escalation detection, and forensic analysis of affected Windows…

omribaso/sccm-cve-2026-47301-remote-code-execution-exploit

Proof-of-concept exploit chain (CVE-2026-47301) for Microsoft Configuration Manager (SCCM), combining a broken access, CAB arbitrary-write path…

gmh5225/0xguard

Simple Anti-cheat library for applications that use C++ on windows. #PastedProtection

phackt/wptsextensions.dll

WptsExtensions.dll for exploiting DLL hijacking of the task scheduler.

sailay1996/cdpsvclpe

Windows Local Privilege Escalation via CdpSvc service (Writeable SYSTEM path Dll Hijacking)

hackerhouse-opensource/iscsicpl_bypassuac

Autoelevate DLL search-order hijacking UAC bypass for x64 Windows 7–11, abusing 32-bit iscsicpl.exe via SysWOW64 to execute code without a UAC prompt.

choisg/onedriveupdatersideloading

Payload for DLL sideloading of the OneDriveUpdater.exe, based on the PaloAltoNetwork Unit42's blog post

iilegacyyii/exportdumper

A small tool I made to dump the export table of PE files. The primary use case was intended for use within DLL proxying.

playboisk8/poc-cve-2017-8464-opencalculator

Exploiting the .lnk vulnerability and operating system handling mechanisms regarding explorer.exe and USB drives.

hackerhouse-opensource/nofaxgiven

Code Execution & Persistence in NETWORK SERVICE FAX Service

d3lb3/keefarcereborn

A standalone DLL that exports databases in cleartext once injected in the KeePass process.

dodo-sec/astaroth-deobfuscator

IDA python script for deobfuscating Astaroth/Guildma injector DLL

daddycocoaman/azbelt

AAD related enumeration in Nim

attl4s/freemetsrvloader

freeBokuLoader fork which targets and frees Metsrv's initial reflective DLL package