Transparent proxy server that works as a poor man's VPN. Forwards over ssh. Doesn't require admin. Works with Linux and MacOS. Supports DNS tunneling.

Privilege Escalation Enumeration Script for Windows

A tool for generating multiple types of NTLMv2 hash theft files by Jacob Wilkin (Greenwolf)

Avalonia-based .NET Decompiler (port of ILSpy)

Recover the default privilege set of a LOCAL/NETWORK SERVICE account

Never ever ever use pixelation as a redaction technique

Easy logging and screen capturing for Tmux.

Pentest Report Generator

A list of public penetration test reports published by several consulting firms and academic security groups.

Domain Password Audit Tool for Pentesters

This tool compares a targets patch levels against the Microsoft vulnerability database in order to detect potential missing patches on the target. It also notifies the user if there are public expl…

PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities.

Malicious shortcut generator for collecting NTLM hashes from insecure file shares.

SharpDPAPI is a C# port of some Mimikatz DPAPI functionality.

PowerShell module to query SQLite databases

Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process.

Windows - Weaponizing privileged file writes with the Update Session Orchestrator service

Loads a custom dll in system32 via diaghub.

Use CVE-2020-0668 to perform an arbitrary privileged file move operation.

C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527

Exploit allowing you to read registry hives as non-admin on Windows 10 and 11

Proof of concept for abusing SeLoadDriverPrivilege (Privilege Escalation in Windows)

This is a standalone exploit for a vulnerable feature in Capcom.sys

Capcom Rootkit POC

Defeating Windows User Account Control

Use SE_BACKUP_NAME/SeBackupPrivilege to access objects you shouldn't have access to

SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by…

Kernel mode WinDbg extension and PoCs for token privilege investigation.

Another Windows Local Privilege Escalation from Service Account to System

Compiled Binaries for Ghostpack