Pentester

LPE exploit for CVE-2024-0582 https://github.com/ysanatomic/io_uring_LPE-CVE-2024-0582

Everything I Know About the Xz Backdoor https://boehs.org/node/everything-i-know-about-the-xz-backdoor

GitHub - berylliumsec/neutron: AI Powered Terminal Based Ethical Hacking Assistant https://github.com/berylliumsec/neutron

CVE-2024-2432 Palo_Alto GlobalProtect EoP https://github.com/Hagrid29/CVE-2024-2432-PaloAlto-GlobalProtect-EoP

A Practical Tutorial on PCIe for Total Beginners on Windows https://ctf.re/windows/kernel/pcie/tutorial/2023/02/14/pcie-part-1/ PCIe Part 2 - All About Memory: MMIO, DMA, TLPs, and more! https://ctf.re/kernel/pcie/tutorial/dma/mmio/tlp/2024/03/26/pcie-part-2/

Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 99.4% in KernelCTF images. https://github.com/notselwyn/cve-2024-1086

Tycoon 2FA: an in-depth analysis of the latest version of the AiTM phishing kit https://blog.sekoia.io/tycoon-2fa-an-in-depth-analysis-of-the-latest-version-of-the-aitm-phishing-kit/

Attacking AWS https://rezaduty-1685945445294.hashnode.dev/attacking-aws

VM Escape Exploit for Parallels Desktop Hypervisor (Pwn2Own 2021) source code + video walkthrough https://zerodayengineering.com/research/pwn2own-2021-vm-escape.html A virtual machine escape exploit will typically require kernel privileges in the guest OS. In this exploit it off-loading the reverse-engineered toolgate protocol implementation to a Python module, while keeping low-level kernel code minimal, just enough to implement the attack interface - a nod to the principle of least privilege in systematic software engineering, which is missed a lot in non-trivial exploit development. ⓒ Alisa Shevchenko

Windows Kernel Pool (clfs.sys) Corruption Privilege Escalation. (CVE-2023-36424) https://github.com/Nassim-Asrir/CVE-2023-36424

UAC Bypass https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e

Grok open release https://github.com/xai-org/grok-1

Java deserialization tricks https://www.synacktiv.com/publications/java-deserialization-tricks

Exploit Development: No Code Execution? No Problem! Living The Age of VBS, HVCI, and Kernel CFG https://connormcgarr.github.io/hvci/

Two Bytes is Plenty: FortiGate RCE with CVE-2024-21762 https://www.assetnote.io/resources/research/two-bytes-is-plenty-fortigate-rce-with-cve-2024-21762

WORKSHOP ⧸⧸ Reversing with Ghidra https://www.youtube.com/watch?v=CO70I0813Gk

FuncAddressPro A stealthy, assembly-based tool for secure function address resolution, offering a robust alternative to GetProcAddress. https://github.com/WKL-Sec/FuncAddressPro

Experimental Windows x64 Kernel Rootkit. https://github.com/eversinc33/Banshee

Source Code Disclosure in IIS 10.0! Almost. There is a method to reveal the source code of some .NET apps. Here's how it works. https://swarm.ptsecurity.com/source-code-disclosure-in-asp-net-apps/

APKDeepLens - tool to scan Android applications for security vulnerabilities https://github.com/d78ui98/APKDeepLens