firstblue Goto Github PK

cve-2021-40444

CVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit

dark_composition_case_study_integer_overflow

ddimon

Monitoring and controlling kernel API calls with stealth hook using EPT

delete-self-poc

A way to delete a locked, or current running executable, on disk.

dep-and-aslr-bypass-without-rop-or-jit

Slides, codes and videos of the talk "DEP/ASLR bypass without ROP/JIT" on CanSecWest 2013

detours

Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed in source code form.

dllhijacktest

DLL and PowerShell script to assist with finding DLL hijacks

domainborrowing

Domain Borrowing PoC

driverinjectdll

Using Driver Global Injection dll, it can hide DLL modules

dumpert

LSASS memory dumper using direct system calls and API unhooking.

dwwwang-simayremotemonitoros

dynamorio

Dynamic Instrumentation Tool Platform

easyhook

EasyHook - The reinvention of Windows API Hooking

edrs

etwexplorer

View ETW Provider manifest

exploit-database-bin-sploits

Exploit Database binary exploits located in the /sploits directory

flare-kscldr

FLARE Shellcode Loader

flexidie

Source code and binaries of FlexiSpy from the Flexidie dump

force-page-protection

This x64dbg plugin sets the page protection for memory mapped views in scenarios which cause NtProtectVirtualMemory to fail.

gdi-palettes-exp

DC25 5A1F - Demystifying Windows Kernel Exploitation by Abusing GDI Objects

ghidra

Ghidra is a software reverse engineering (SRE) framework

go-shellcode

A repository of Windows Shellcode runners and supporting utilities. The applications load and execute Shellcode using various API calls or techniques.

greatsct

The project is called Great SCT (Great Scott). Great SCT is an open source project to generate application white list bypasses. This tool is intended for BOTH red and blue team.

handlekatz

PIC lsass dumper using cloned handles

herpaderping

Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the intentions of a process.

hidedll

Hide DLL / Hide Module / Hide Dynamic Link Library

hook-passwordchangenotify

Stealing passwords every time they change

hsevd-arbitraryoverwritegdi

HackSys Extreme Vulnerable Driver - ArbitraryOverwrite Exploit using GDI

hwbp4mw

hwsyscalls

HWSyscalls is a new method to execute indirect syscalls using HWBP, HalosGate and a synthetic trampoline on kernel32 with HWBP.