N1k0la-T / CVE-2023-36745
☆163Updated last year
Related projects ⓘ
Alternatives and complementary repositories for CVE-2023-36745
- Leak of any user's NetNTLM hash. Fixed in KB5040434☆239Updated 2 months ago
- AV bypass while you sip your Chai!☆206Updated 5 months ago
- ☆212Updated 7 months ago
- Reflective DLL to privesc from NT Service to SYSTEM using SeImpersonateToken privilege☆199Updated 11 months ago
- 🐍 Double Venom (DVenom) is a tool that provides an encryption wrapper and loader for your shellcode.☆158Updated last year
- Escalate Service Account To LocalSystem via Kerberos☆389Updated last year
- An aggressor script that can help automate payload building in Cobalt Strike☆111Updated 9 months ago
- ☆128Updated 9 months ago
- A Tool that aims to evade av with binary padding☆135Updated 4 months ago
- Extract and execute a PE embedded within a PNG file using an LNK file.☆208Updated last week
- Kill AV/EDR leveraging BYOVD attack☆307Updated last year
- NoArgs is a tool designed to dynamically spoof and conceal process arguments while staying undetected. It achieves this by hooking into W…☆146Updated 6 months ago
- SeImpersonate privilege escalation tool for Windows 8 - 11 and Windows Server 2012 - 2022 with extensive PowerShell and .NET reflection s…☆237Updated 5 months ago
- Evasive Golang Loader☆130Updated 3 months ago
- Execute shellcode files with rundll32☆181Updated 9 months ago
- ☆146Updated 3 months ago
- PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS.☆364Updated 4 months ago
- BOF and Python3 implementation of technique to unbind 445/tcp on Windows via SCM interactions☆264Updated 3 months ago
- ☆229Updated 10 months ago
- CVE-2024-38200 - Microsoft Office NTLMv2 Disclosure Vulnerability☆124Updated 2 weeks ago
- Leverage WindowsApp createdump tool to obtain an lsass dump☆141Updated last month
- Use ESC1 to perform a makeshift DCSync and dump hashes☆198Updated last year
- Terminate AV/EDR Processes using kernel driver☆336Updated last year
- Different methods to get current username without using whoami☆172Updated 8 months ago
- Fileless atexec, no more need for port 445☆325Updated 7 months ago
- Extracting NetNTLM without touching lsass.exe☆223Updated 11 months ago
- Credential Guard Bypass Via Patching Wdigest Memory☆309Updated last year
- The GPOddity project, aiming at automating GPO attack vectors through NTLM relaying (and more).☆262Updated this week
- Microsoft SharePoint Server Elevation of Privilege Vulnerability☆227Updated last year