Privilege-Escalation

Reverse Shell WhatsApp is a tool that exploits the WhatsApp Desktop application on Windows to enable remote code execution via a crafted `.pyz` file. When the victim opens the file, it is executed directly by the Python interpreter without any security prompts, allowing the attacker to gain full control of the victim's machine through privilege escalation. Notable features include bypassing multiple layers of security, such as Windows Defender and UAC, and operating discreetly within a trusted application context.

The repository provides a comprehensive collection of cybersecurity bookmarks curated by a senior information security engineer, focusing on critical topics such as OSINT, exploitation, privilege escalation, and malware analysis. It features over 40 tools for reconnaissance, privacy, and attack methodologies, along with curated news sources, making it a valuable resource for cybersecurity professionals looking to enhance their operational security and situational awareness. Notable features include categorized tools for specific cybersecurity tasks and a visually engaging presentation of the content.

CrystalPotato is a privilege escalation tool designed for Windows, enabling users with `SeImpersonatePrivilege` to elevate their permissions to SYSTEM level. It leverages DCOM OXID Resolver and named pipe impersonation techniques, dynamically resolving Windows APIs and allowing for the execution of commands, reverse shells, or local admin user creation. Notable features include XOR-obfuscated strings, command output by default, and a compiled single-file executable with no dependencies.

The Offensive Linux Privilege Escalation tool serves as a comprehensive guide to help users escalate from low-privileged Linux access to root, covering various techniques such as sudo and SUID abuse, kernel exploits, and credential mining. Its primary use case is educational, providing detailed methodology, enumeration scripts, and a structured approach to experience in privilege escalation while emphasizing lawful and authorized testing. Notable features include over 50 documented techniques, automated enumeration scripts, a methodology checklist, and practical lab setups for hands-on learning.

Offensive Windows Privilege Escalation is a comprehensive guide designed for escalating privileges from a low-privileged Windows environment to Administrator or SYSTEM level, utilizing various techniques such as service misconfigurations, registry exploits, UAC bypass, and token-privilege abuse. The tool emphasizes an offensive security methodology, offering over 75 structured notes complete with hands-on exploitation and detection guidance, alongside ready-to-use commands and methodology checklists. It serves as an educational resource exclusively for authorized testing scenarios, ensuring ethical use in cybersecurity practices.

The HackTheBox-Active-Directory-Labs repository provides a collection of walkthroughs focused on Active Directory enumeration and attacks as part of the Hack The Box CPTS career path. Notable features include the inclusion of visual Obsidian .canvas files for enhanced understanding and thoroughly documented processes to uncover flags, with partial censorship to prevent scraping. This resource is intended for learners and security practitioners aiming to deepen their knowledge in Active Directory security.

The World Intelligence MCP Server provides real-time global intelligence across over 30 domains by integrating 120 tools compatible with the Model Context Protocol. It features a live ops-center dashboard and a Qdrant vector store for efficient semantic search, allowing users to query historical data on various subjects such as military activity, cyber threats, and economic indicators using natural language. This tool is particularly beneficial for AI agents requiring comprehensive world awareness without reliance on paid data subscriptions.

The LPE Toolkit 2026 (xpl2026) is an advanced collection of 26 static binaries targeting local privilege escalation (LPE) vulnerabilities on Linux systems for penetration testing and security research. Notable features include universal compatibility across various Linux distributions and kernel versions, automatic detection and filtering of applicable exploits, and an interactive user interface for seamless operation. The toolkit is especially significant for its inclusion of newly researched exploits, enhancing its utility for security professionals.

The CVE-2023-22515 exploit script is designed to target and exploit the critical Broken Access Control vulnerability in Confluence Server and Data Center instances, enabling unauthorized access. It offers two operational modes: Normal for single-target exploitation via a provided URL, and Mass for bulk processing using a list of target URLs from a file, with output detailing the success of the exploitation attempts. Notable features include real-time logging of the exploitation process and clear output indicating whether unauthorized access was achieved.

LinEnum is a Linux enumeration script designed to gather extensive system information, user details, and assess potential security weaknesses within a Linux environment. It provides various checks, including user permissions, network configuration, service status, and system vulnerabilities. Notably, it allows the user to export reports, perform thorough or quick scans, and search for specific keywords within files, making it an invaluable tool for security assessments and post-exploitation analysis.

BeRoot is a post-exploitation tool designed to identify common misconfigurations that could lead to privilege escalation on a target system. Operable on Windows, Linux, and Mac OS, it focuses solely on providing information about potential escalation paths without performing any actual exploitation. Noteworthy features include its integration into the pupy project for execution in memory, ensuring that no traces are left on the disk.

The Elevate Kit demonstrates how to use third-party privilege escalation attacks with Cobalt Strike's Beacon payload.

PEASS-ng is a suite of scripts designed for detecting local privilege escalation vulnerabilities on Windows, Linux/Unix, and macOS systems. Its notable features include output formatting in JSON, HTML, and PDF, and a user-friendly presentation of potential misconfigurations to simplify the identification of escalation paths. The tool is intended for authorized penetration testing and educational purposes, emphasizing ethical use.

RoguePotato is a Windows Local Privilege Escalation tool that exploits a service account to gain system-level access. Its primary use case is to facilitate remote command execution by leveraging network redirectors and customizable parameters, such as class identifiers (CLSIDs) and named pipes. Notable features include the ability to run the RogueOxidResolver locally or on a remote machine, along with options for randomizing pipe names to obfuscate the attack's execution.

The "local-root-exploits" repository provides a curated collection of local privilege escalation exploits for Linux systems. Its primary use case is to facilitate security research and testing by demonstrating vulnerabilities that can be exploited to gain root access on local Linux environments. Notable features include organized categories of exploits for different Linux kernel versions and configurations.

This tool demonstrates a local privilege escalation exploit for Sudo versions 1.6.x up to 1.6.9p21 and 1.7.x up to 1.7.2p4, specifically addressing the vulnerability in the sudoedit command that allows arbitrary command execution as the root user. The primary use case is to set up a vulnerable Docker environment for educational testing, enabling attackers to exploit the flaw and gain root access. Notable features include the provision of a simple Docker setup and a scripted exploit for demonstration purposes.

This repository provides a local privilege escalation exploit for the Sudo vulnerability identified as CVE-2015-5602. It utilizes a flaw in the sudoedit functionality that allows a malicious user to exploit symlink attacks, enabling them to gain root access by modifying sensitive files. The tool includes a Docker setup for mimicking a vulnerable environment, along with an exploit script for demonstration purposes.

The rewolf-pcausa-exploit is a Windows local privilege escalation tool targeting the PCAUSA Rawether vulnerability. Its primary use case is to enable users to gain elevated permissions within a Windows environment, exploiting specific weaknesses in the PCAUSA driver. Notable features include its focus on local escalation and detailed documentation linked for further information.

windows-lpe-lite is a local privilege escalation tool targeting Windows XP SP3 and later versions, enabling exploitation of specific CVEs (CVE-2014-4113, CVE-2015-1701, and CVE-2017-0213). Its primary use case is to grant elevated privileges on vulnerable Windows systems through the exploitation of kernel-mode vulnerabilities. Notable features include compatibility with various Windows builds and the ability to execute commands or spawn command prompts with elevated rights.

Yodo is a cybersecurity tool designed to exploit limited sudo permissions to escalate privileges on a Unix-like system, utilizing techniques such as the dirty COW exploit and the Pa(th)zuzu vulnerability check. It features additional checks for overwrite permissions on sudo commands, the examination of command history for privilege escalation opportunities, and the capability to replace commands with root privileges.

adduser-dll is a straightforward dynamic-link library (DLL) that facilitates the creation and addition of users to the local Administrators group on Windows systems. Its primary use case is for administrative automation in user management tasks, allowing customization of usernames, passwords, and group permissions through code modifications. Notable features include its standalone execution via `rundll32.exe` and the ability to be injected or called from other scripts or tools, enhancing flexibility in usage.

The `amd_eop_poc` tool serves as a proof of concept for exploiting a privilege escalation vulnerability (CVE-2020-8950) within the AMD User Experience Program Launcher associated with Radeon Software. Its primary use case is to demonstrate the FileWrite escalation of privileges, enabling unauthorized access to system resources. Notable features include detailed documentation and references to external resources for further context on the vulnerability.

Anyelevate is a Windows x64 privilege escalation tool that leverages the anycall technique to elevate the privileges of a specified process by copying the system process token into the target process's context. The tool operates by manipulating physical memory to enable the execution of tasks with NT AUTHORITY\SYSTEM privileges, making it particularly useful for security researchers and penetration testers looking to demonstrate or exploit privilege escalation vulnerabilities. Notable features include its simplicity of use and the ability to specify a process ID for targeted elevation.

Awesome Infosec is a curated collection of Information Security resources and tools designed to aid individuals in their studies and practices of cybersecurity. It encompasses various topics, including recon, web security, penetration testing, and exploit development, while also providing links to educational courses and labs. The continuously updated repository serves as a valuable resource for both beginners and experts in the field.

AymanSecNotes is a personal compilation of cybersecurity notes in PDF format, primarily serving as a self-study resource for various security domains including mobile, web, and networks. Notable features include plans for future enhancements such as a comprehensive cheatsheet, the transition from PDF to Markdown format, and the inclusion of methodologies and bug hunting tips, aimed at facilitating practical learning and knowledge sharing within the cybersecurity community.

ByeIntegrity Lite is a tool designed to exploit a shell protocol handler hijack to bypass Windows User Account Control (UAC) and achieve elevated privileges for executing programs at a higher integrity level. It specifically alters the handler for the `ms-settings` protocol to redirect it to `cmd.exe`, allowing execution of `fodhelper.exe`, which inherits elevated tokens. Notable features include its simplicity and compatibility with all versions of Windows 10; however, there are no precompiled binaries available to prevent misuse.

ByeIntegrity is a tool designed to bypass Windows User Account Control (UAC) in order to gain elevated Administrator privileges for executing programs at a high integrity level. Its notable features include the ability to hijack DLLs in the Native Image Cache (NIC) without relying on existing native images and the use of an auxiliary file generator (AUXGen) to facilitate the loading of shellcode without direct dependency on system resources. The latest update enhances its speed, reliability, and usability by streamlining the hijacking process and minimizing the initial configuration overhead.

ByeIntegrity 2.0 is a tool designed for bypassing Windows User Account Control (UAC) to gain elevated administrator privileges by leveraging a specific elevated COM interface associated with the Internet Explorer Add-on Installer. It features a methodical approach utilizing the `COMAutoApprovalList` registry key to execute arbitrary programs via an elevated instance of `cmd.exe`, thereby circumventing UAC restrictions. This iteration builds on previous designs, sharing core functionality with the UACMe project while incorporating unique lolbin usage for execution.

ByeIntegrity 3.0 is a tool designed to bypass Windows User Account Control (UAC) to achieve elevated privileges for executing arbitrary programs. It employs an elevated COM interface alongside a shell protocol handler hijack, allowing seamless execution of commands like `cmd.exe` with admin rights. Notable features include the use of the `IWscAdmin` interface and the ability to manipulate URL protocol associations to facilitate the UAC bypass in various Windows versions.

ByeIntegrity 4.0 is a cybersecurity tool designed to exploit User Account Control (UAC) vulnerabilities in Windows for bypassing security mechanisms and achieving elevated privileges. It modifies the `windir` environment variable and utilizes a custom URL protocol to launch `cmd.exe` as an administrator, successfully circumventing UAC protections. Key features include the leveraging of COM interface methods and environment variable manipulation, making it an effective tool for demonstrating UAC bypass techniques in Windows environments.

ByeIntegrity V is an advanced tool designed to bypass User Account Control (UAC) across all notification levels, granting elevated Administrator privileges to execute any program. Utilizing a combination of DLL hijacking, environment variable manipulation, and the Task Scheduler, it effectively circumvents UAC prompts by launching tasks with the "Run with highest privileges" setting enabled. This tool is particularly notable for its ability to operate without requiring administrator access initially or modifying critical system components, making it a stealthy approach for privilege escalation in Windows environments.

ByeIntegrity 8.0 is a sophisticated Windows privilege escalation tool that exploits design and security flaws in the operating system, operational even with User Account Control (UAC) set to the highest level. It utilizes the Task Scheduler to trigger the WDI ResolutionHost task, manipulating environment variables to load a custom payload that executes with elevated privileges. Key features include controlled event triggering via ETW and direct communication with the Program Compatibility Assistant, enabling a bypass of potential policy restrictions.

PrivEsc-Clippy is a Windows privilege escalation enumeration script designed to assist users in identifying potential vulnerabilities for privilege escalation. Key features include various command options for enumeration, report generation, file downloading, and administrative task execution, making it particularly useful in Capture The Flag (CTF) scenarios. The tool operates independently of Python installation, allowing easy packaging into a standalone executable.

This repository provides a proof-of-concept (PoC) for exploiting the CVE-2020-1034 vulnerability, which allows for privilege escalation on unpatched Windows 10 systems. It is primarily used for security research and understanding the exploitability of this specific vulnerability, with notable features including documentation links for deeper insight into exploitation techniques and the context of the vulnerability's discovery and remediation.

The CVE-2020-28243 tool exploits a command injection vulnerability within SaltStack's Salt, allowing for privilege escalation on affected minions when the master executes the `restartcheck` command. Notable features include a straightforward exploit script (`exploit.sh`) for executing arbitrary commands, and the capability to utilize pre-compiled static binaries if gcc is unavailable on the target system. This tool targets SaltStack versions from 2016.3.0rc2 to 3002.2, requiring specific access permissions to function effectively.

CVE-2021-27965 is a proof-of-concept (PoC) exploit targeting a local privilege escalation vulnerability in the MICSYS Windows driver, MsIo64.sys. This tool leverages stack-based buffer overflow in the driver's IOCTL dispatch routine, allowing arbitrary physical memory mapping, port access, and potential system crashes. Notable features include the ability to execute IOCTL requests that bypass Windows security mechanisms, facilitating unauthorized access to system-level operations.

The cve-2022-21882-poc repository provides a proof of concept (PoC) for the local privilege escalation vulnerability identified as CVE-2022-21882. Its primary use case is to demonstrate the exploitability of this vulnerability in a controlled environment, facilitating security research and testing. Notable features may include detailed instructions for replication of the exploit and potential impacts of the vulnerability.

The Privileged Access Management (PAM) repository is a curated collection of resources that encompasses software best practices, techniques, libraries, frameworks, and educational materials related to securing and managing privileged access to critical assets in cybersecurity. Notable features include categorized content for various platforms such as Linux and Windows, as well as practical guides on privilege escalation methods and access control strategies. This community-driven initiative aims to facilitate knowledge sharing and enhance best practices in the field of PAM.

Delete2SYSTEM is a tool designed to exploit arbitrary file and directory deletion vulnerabilities to achieve NT AUTHORITY\SYSTEM privileges on Windows systems. Utilizing methods derived from known techniques, it specifically targets deletion of critical folders related to Windows Error Reporting and Windows Media Player, leveraging vulnerabilities such as CVE-2020-1170 and CVE-2020-1571. Notable features include integration with the NtApiDotNet library and the ability to weaponize Windows services for privilege escalation.

Dirty Sock is a privilege escalation tool for Linux systems that exploits a vulnerability in the snapd API, allowing unauthorized user creation and root access. It provides two versions: the first requires an internet connection and SSH service to create a local user using Ubuntu SSO, while the second operates without these requirements, leveraging the installation of a "devmode" snap to execute arbitrary commands and bypass access controls. Notably, the tool can be used on both Ubuntu and other distributions with the snapd package installed, making it versatile in various environments.

The Disable Ctrl+Alt+Del tool is designed to disable the Ctrl+Alt+Del hotkey on Windows 10 x64 systems, requiring administrative privileges for operation. It provides a simple compilation method using g++ or other compilers, making it accessible for users needing to restrict this key combination for security or user interface purposes. Notably, it has been tested and confirmed to work on the specified Windows version.

DLLSpy is a DLL hijacking detection tool designed for Windows environments that identifies vulnerabilities in running processes and services by scanning their binaries for potential hijacking threats. It features three modes of operation: dynamic scanning of loaded modules, static search for DLL references in binaries, and recursive scanning of DLLs to uncover further hijack potential. The tool requires administrative privileges for comprehensive scanning and outputs results in CSV format by default.

The Docker Privesc script is designed to exploit misconfigurations in Docker environments for privilege escalation purposes. Its primary use case is to gain elevated permissions by leveraging Docker's default configurations, especially in scenarios where a user has access to run Docker on a target system. Notable features include simple usage instructions, requirements for operational conditions, and illustrations of potential mitigation strategies to prevent such attacks.

The "am0nsec/exploit" repository serves as a collection of exploit scripts and related resources, although the majority of the artifacts are not original contributions from the maintainer. Its primary use case is to provide a centralized resource for penetration testers and security researchers seeking various exploits. Notably, it includes links to the maintainer's social media and personal website for further engagement.

IAM-Deescalate is a security tool designed to mitigate privilege escalation risks within AWS identity and access management (IAM) by identifying IAM users and roles susceptible to escalation. It utilizes NCC Group's PMapper to model relationships in an AWS account and provides commands to audit risks, plan remediation, apply policies, and revert changes. Notable features include the ability to dynamically manage inline policies and the use of explicit denies to break risky permissions paths between non-administrative and administrative principals.

IAM-Flaws is a bash script designed to identify misconfigurations in AWS IAM User and Group Policy Permissions, facilitating privilege escalation assessments. Its primary use case involves conducting CIS Benchmark checks, enumerating IAM entities (users, groups, policies), and scanning for potential privilege escalation vulnerabilities. Notable features include a modular design for executing various checks independently, as well as an integrated output logging mechanism for comprehensive analysis.

libinject is a static library designed for DLL injection into Windows x64 processes, featuring handle elevation capabilities to bypass certain protections. It enables users to obtain a process handle with higher privileges using elevated access, facilitating interaction with protected processes for debugging or analysis purposes. Notable features include process handle acquisition, memory allocation in target processes, and remote thread creation to execute the injected DLL.

Linux Kernel Exploitation is a laboratory tool designed for practicing various exploitation techniques within the Linux kernel environment. It covers advanced exploitation methods such as ret2user, memory manipulation strategies, and kernel information leaks, while providing comprehensive guidelines for compiling and preparing kernel modules and necessary utilities. Notable features include detailed instructions for building kernel sources, configuring BusyBox, and setting up an initial filesystem for testing.

Love.exe is a development tool designed for exploitation and penetration testing in Windows environments, specifically optimized for Windows 10 and 11 with default UAC settings. It offers functionalities to assist security professionals in identifying vulnerabilities within applications, and it encourages community engagement for enhancements and support. The repository is currently under active development, indicating ongoing updates and feature additions.

MIDA - Multitool is a comprehensive Bash script designed for system enumeration, vulnerability identification, and privilege escalation after system compromise. It integrates features from previous scripts like SysEnum and RootHelper, allowing users to gather detailed system information, check for useful utilities, download external tools, and search for potential cleartext credentials. Notably, it provides a robust framework for facilitating various tasks crucial for post-exploitation activities.

Mobile Heavy Artillery is a comprehensive toolkit designed for red teaming operations, facilitating reconnaissance, exploitation, and privilege escalation tasks. It includes a curated collection of open-source tools for network enumeration, web vulnerability assessment, secrets discovery, and OSINT activities, all easy to install and manage through a makefile. Notable features include a wide range of utilities for various cybersecurity processes, making it a versatile choice for penetration testers and security researchers.

The OSCP repository serves as a centralized resource for individuals preparing for the Offensive Security Certified Professional (OSCP) exam, compiling useful materials from various sources including websites, blogs, and books. Key features include organized sections for methodologies, automation scripts, cheat sheets, and troubleshooting documentation, all formatted for compatibility with Obsidian for enhanced note-taking and visual data representation. While the maintainers are no longer actively updating the repository, it aims to remain a valuable reference for future OSCP candidates.

The OSCP - PWK (PenTesting With Kali) Notes repository provides comprehensive documentation and practical notes covering the entire curriculum of the OSCP certification course, specifically designed for penetration testing with Kali Linux. It includes detailed sections on various topics such as information gathering, vulnerability scanning, privilege escalation, and exploitation techniques, along with command examples for effective usage. Notable features include organized content for efficient study and reference, alongside practical commands and scripts aimed at enhancing penetration testing capabilities.

PE-Linux is a Linux privilege escalation tool designed to gather extensive system and environment information to identify potential vulnerabilities and misconfigurations. Its primary use case is to assist security professionals in auditing Linux systems for privilege escalation risks through features such as user enumeration, vulnerability checks, log analysis, and the collection of sensitive information like passwords and SSH keys. Notable features include kernel vulnerability checks, cron job enumeration, and detailed system information gathering to facilitate privileged access exploitation assessments.

The polkadots tool is a local privilege escalation exploit targeting CVE-2021-3560, allowing the creation of a new privileged user to gain root access on affected Linux distributions such as RHEL 8, Fedora 21, Debian testing, and Ubuntu 20.04. It includes functionality to generate hashed passwords using OpenSSL, enabling users to customize account credentials during the exploit execution. Notable features include customizable account names and password hashes, along with default settings for easy deployment.

The Privilege Escalation tool in this repository is designed for conducting structured labs on AWS IAM privilege escalation techniques. Its primary use case is to educate users on identifying vulnerabilities and exploiting permission misconfigurations within AWS environments, utilizing tools like Pacu and AWS-IAM-Permissions-Scanner. Notable features include step-by-step guides for creating low-privilege IAM users, testing permissions, and demonstrating privilege escalation methods through policy manipulation.

The pwk-oscp repository serves as a comprehensive resource for aspiring penetration testers preparing for the OSCP certification, offering a curated collection of scripts, guides, and links to vulnerable machines and challenges. Notable features include categorized sections for enumeration, privilege escalation techniques, and certification resources, alongside curated lists of relevant literature and practical exercises from platforms like HackTheBox and VulnHub. This tool is particularly useful for individuals seeking structured guidance and useful materials throughout their penetration testing journey.

RootHelper is a Linux privilege escalation tool that facilitates the exploitation process on compromised systems through an array of eleven scripts designed for enumeration, exploit suggestion, and deployment. Notable features include support for command-line flags for quicker access and execution, as well as a collection of additional tools for enumeration and exploit deployment, such as Auto-Root-Exploit and Linux Smart Enumeration. This comprehensive suite aids penetration testers in efficiently performing privilege escalation tasks.

Rust-Privesc is a collection of proof-of-concept (POC) tools designed to demonstrate User Account Control (UAC) bypass techniques implemented in Rust. It includes methods such as exploiting fake trusted directories and manipulating environment variables to execute command shell processes. Notable features include straightforward implementations of UAC bypass methods and the execution of `cmd.exe` as a default behavior.

SharpLink is a C# library that enables users with low privileges to create file system and registry symbolic links on Windows systems in an object-oriented manner via PowerShell. It incorporates advanced techniques for symbolic link management, allows batch operations through LinkGroups, and provides robust functionalities for creating and removing both filesystem and registry links seamlessly. Notable features include the ability to handle multiple links collectively and the integration with PowerShell for enhanced usability.

SUD (Super User Do) is a lightweight UNIX tool designed for privilege escalation, enabling designated users in specific system groups (admin, wheel, sudo, or sud) to execute commands with root permissions without a password. It prioritizes simpler code and easier audits compared to traditional tools like sudo, while offering a public domain license and a literate programming approach for improved readability and maintainability. Notably, SUD features a minimalistic design with fewer dependencies and no configuration files, making it suitable for specific multi-user privilege isolation scenarios.

SUIDer is a Linux script designed to streamline the privilege escalation process by identifying exploitable binaries with the SUID bit set. It leverages GTFObins to provide relevant exploitation methods and generates links for reference. Notably, it emphasizes caution, as some SUID binaries may require custom methods not covered by the provided resources.

Suidsploit is a penetration testing tool designed to exploit 137 files with the Suid bit set, enabling attackers to potentially gain elevated privileges on a target system. Its primary use case includes obtaining a root shell, accessing sensitive files such as /etc/shadow, and establishing reverse shells. Notable features include the ability to download the tool via a simple HTTP server and its focus on user-friendly execution on both the attacker's and victim's machines.

UACHooker is a proof-of-concept reflective DLL designed to exploit the AicLaunchAdminProcess function in explorer.exe for privilege escalation by manipulating UAC prompts. It achieves this by redirecting user-initiated administrative commands to run a specified payload instead, masquerading it as legitimate software, while showing misleading arguments. The tool’s notable features include its ability to create indistinguishable UAC prompts for unsigned executables and the potential for future enhancements such as support for additional hooking libraries and broader target applications.

Uptux is a specialized tool for conducting privilege escalation checks on modern Linux systems, focusing on vulnerabilities in systemd units, D-Bus settings, and Unix socket files. Notable features include the ability to identify writable executables, broken symlinks, and overly permissive service configurations without requiring installation, making it convenient for use in restricted environments. The tool runs entirely from a single Python script and provides options for logging and debugging output.

Wconsole is a PowerShell-based tool designed for penetration testing on Windows systems, enabling comprehensive checks of OS versions, configurations, and security settings. It features functions for user enumeration, firewall status, process management, and various privilege escalation checks, making it a versatile hand-script for security testing. The tool can be executed locally or remotely, providing flexibility in assessment execution.

WinSudo is a tool designed to execute commands with local system privileges on Windows. It allows users to create access tokens and processes while enabling various privileges and group configurations. Notable features include strict parameter checking to mitigate memory violations, the ability to inherit the current console window, and user-friendly LPCSTR submissions for user and group names.

Active-Directory-Exploitation is a comprehensive PowerShell-based toolkit designed for conducting penetration testing and security assessments on Active Directory environments. Its primary use case is to enumerate domains, escalate privileges, enable lateral movement, and achieve persistence through various methodologies, including Kerberos ticket manipulation and exploitation of SQL Server trusts. Notable features include extensive modules for local and domain privilege escalation, detailed methods for lateral movement and persistence, and capabilities for cross-forest attacks.

AuthInspector is a Golang-based tool designed for efficient authorization and authentication testing, specifically for extracting request details from BurpSuite exports. It utilizes Goroutines to conduct comprehensive checks based on user-defined headers and outputs results in a structured CSV format. Notable features include customizable request options, support for proxy configurations, and the ability to include request/response bodies in results.

ChainReactor is an AI-driven tool designed to automate the discovery of privilege escalation chains on Unix systems. By analyzing system information and known vulnerabilities, it models the escalation process using Planning Domain Definition Language (PDDL) to generate potential exploitation chains. Notable features include its ability to rediscover existing exploits, identify new chains, and its successful evaluation on various platforms, including Amazon EC2 and Digital Ocean.

Confluence Hack is a tool designed to exploit CVE-2023-22515, enabling the creation of a new administrative user and compromising audit logs in Confluence servers. It features a web-based command shell plugin that allows for executing commands remotely, verified to work on Confluence Server 8.5.1. The repository is intended for educational purposes only and emphasizes ethical use.

CVE-2022-27502 is a DLL hijacking exploit targeting RealVNC Server versions up to 6.9.0, allowing for arbitrary command execution by leveraging a vulnerable installation process. The tool enables users to execute any command through a crafted DLL that captures the output in a specified output file. Notable features include the ability to modify the executed command by editing specific code lines and recompiling the DLL.

This repository provides an exploit for the Parallels Desktop vulnerability CVE-2023-27326, which allows local attackers to escalate privileges on affected installations. The exploit targets a flaw in the Toolgate component, enabling the execution of arbitrary code due to inadequate validation of user-supplied paths in file operations. It is notable for its specific applicability to version 18.0.0 of Parallels Desktop and the details of its exploitation, which are documented alongside a proof of concept.

Wall-Escape (CVE-2024-28085) is an exploit tool designed to leverage a vulnerability in the util-linux wall command that allows attackers to inject escape sequences into command line arguments, potentially leaking sensitive information such as user passwords. The tool sets up an environment to execute commands while monitoring for password input, effectively capturing credentials during user interactions—particularly in contexts like SSH login or sudo commands. Notable features include the ability to manipulate command outputs and create a fake prompt that misleads users into revealing their passwords.

CVE-2024-33352 identifies a critical vulnerability in BlueStacks for Windows, affecting versions prior to 10.40.1000.502. This flaw allows unprivileged users to access and modify configuration files stored in a world-writeable directory, enabling them to backdoor the virtual machine and gain code execution as a privileged user by manipulating shared folder settings. The README provides a detailed exploitation method and emphasizes the necessity of updating to a patched version to mitigate this security risk.

Cybersec Notes is a comprehensive, expandable checklist aimed at individuals seeking to enhance their knowledge in various cybersecurity domains, including application, mobile, API, and network security. The tool features a structured outline of key topics and vulnerabilities, supplemented with resource links, while encouraging community contributions for continuous improvement and accuracy. Notable aspects include coverage of OWASP Top 10 vulnerabilities across multiple platforms and concepts related to DevSecOps.

DeadPotato is a privilege escalation tool designed to exploit the DCOM RPCSS vulnerability to gain NT AUTHORITY\SYSTEM level access on Windows systems. Its primary use case includes executing commands, creating new administrator accounts, establishing reverse shells, and dumping sensitive credentials using various modules like `-cmd`, `-newadmin`, and `-mimi`. Notable features include the ability to disable Windows Defender and collect domain data for BloodHound, making it versatile for penetration testing and security assessments.

Elevation Station is a privilege escalation tool that facilitates the duplication and manipulation of system tokens to gain higher privileges on Windows systems. Its primary use case includes bypassing User Account Control (UAC) and achieving SYSTEM-level access, with notable features such as becoming a TrustedInstaller and utilizing various escalation methods like process and thread duplication, along with named pipes and remote thread injection. This tool aims to avoid antivirus detection while providing users with a deeper understanding of token management and escalation techniques.

EPScalate is a proof-of-concept exploit that targets an elevation of privilege vulnerability (CVE-2023-31497) in QuickHeal's Seqrite Enterprise Endpoint Security solution. The tool leverages weak permissions on directory and file installations, enabling low-privilege users to escalate privileges to root by overwriting executable files or manipulating startup scripts. Notable features include the ability to perform privilege escalation via either daemon binary overwrites or injecting reverse shell commands into system initialization scripts.

EvilTree is a Python3 tool that serves as a standalone remake of the classic "tree" command, enhanced with the capability to search for user-defined keywords or regex patterns within files. Its primary use case is to assist in identifying sensitive information within complex directory structures during post-exploitation enumeration. Notable features include the ability to highlight matches in search results, support for both keyword and regex searches, and an option to filter results to show only files containing matching content.

Flanders-Trojan is a Windows-based trojan developed for academic purposes that employs C++ and consists of three main components: a Loader for initial setup and privilege escalation, a Payload for executing various malicious actions (such as file encryption, keylogging, and DDoS attacks), and a Server that functions as the command and control center for managing infected devices. Notable features include VM detection, UAC bypass, and real-time communication with a C2 server, highlighting its capabilities in orchestrating cyberattacks and gathering sensitive information.

The GCP-Attack-Defense project provides comprehensive documentation of attack and defense vectors specifically in the Google Cloud Platform (GCP), aiding users in understanding security threats and mitigation strategies. It features detailed research on various aspects of cloud security, including privilege escalation and defense evasion, as well as tools like gLess and GATOR for practical application. The project serves both as an educational resource and a reference for cybersecurity professionals studying GCP vulnerabilities.

GetSystem is a tool designed for elevating privileges by spawning SYSTEM shells effectively. Its primary use case is in penetration testing and security assessments, where gaining SYSTEM level access is crucial. Notable features include an included binary for ease of use and streamlined execution.

The HackTheBox repository contains write-ups detailing the author’s solutions to various HackTheBox machines, primarily aimed at preparing for the Offensive Security Certified Professional (OSCP) certification. Notable features include comprehensive problem-solving approaches and methodologies applicable to penetration testing scenarios.

The Jr Penetration Tester repository provides solutions and an answer key for the Penetration Tester learning path on TryHackMe, aimed at equipping users with essential skills for a career in penetration testing. It covers various critical topics, including web hacking, Burp Suite, network security, vulnerability research, and exploitation techniques using Metasploit. Notable features include comprehensive sections that guide learners through foundational concepts and practical applications in cybersecurity.

The Linux Privilege Escalation Cheatsheet provides a comprehensive collection of detection and exploitation methods for common privilege escalation vulnerabilities in Linux systems. It includes techniques for exploiting SUID binaries, weak file permissions, and environmentally controlled executions, along with practical command examples for each method. Notable features include links to tools like `linux-exploit-suggester`, as well as code snippets for exploits that can be compiled and executed, making it a valuable resource for penetration testers and security professionals.

Linux-Kernel-VR-Exploitation is a toolset designed for vulnerability research and exploitation specifically targeting the Linux and Android kernel. It provides a comprehensive environment setup guide, along with resources for exploitation tutorials, practice playgrounds, and detailed academic research papers, facilitating both practical experimentation and theoretical understanding of kernel vulnerabilities. Notable features include curated links to extensive educational materials, CTF challenges for skill development, and insights into kernel tracing and various exploitation techniques.

The Linux Privilege Escalation Cheatsheet provides a comprehensive checklist of strategies and techniques for escalating privileges on Linux systems. It encompasses various methods, such as exploiting weak configurations and file permissions, utilizing scripts like Linux Smart Enumeration and LinEnum for system enumeration, and suggests using manual commands for deeper analysis. Notable features include a structured strategy for conducting privilege escalation assessments and references to additional tools and resources for enhanced exploitation.

The Linux-Privilege-Escalation tool provides a comprehensive set of techniques for escalating privileges on Linux systems. Its primary use case includes identifying vulnerabilities related to kernel exploits, file permissions, and sudo configurations, while notable features include detailed methods for exploiting kernel vulnerabilities, leveraging GTFOBINS for privilege escalation, and examining scheduled tasks and SUID binaries for potential exploitation paths.

LocalAdminSharp is a .NET executable designed for privilege escalation on Windows systems, enabling the creation of local administrator accounts or the addition of existing users to the local administrator group. This tool can be customized for different users and domains and is suitable for standalone execution or integration into other scripts for privilege escalation scenarios. Key features include ease of customization, compatibility with Visual Studio for compilation, and a focus on evading detection by security software.

Lucifer is a Python-based tool designed for shell manipulation and module management within cybersecurity frameworks. Its primary use case involves automating and simplifying the interaction with different shells and related modules, allowing users to set variables, run exploits, and manage options efficiently. Notable features include dynamic module indexing, the ability to spawn alternate shells, and a comprehensive set of commands for module interaction.

MSAPer is an automated mass exploitation tool designed for identifying and exploiting the CVE-2023-3076 vulnerability in MStore API versions below 3.9.9, which enables unauthenticated privilege escalation through mass addition of admin accounts and PHP file uploads. The tool utilizes GNU Parallel for efficient execution and requires a list of target URLs as input. Notable features include the ability to run on both Linux and Windows platforms, along with installation instructions for necessary dependencies.

Payloads All The Things is a comprehensive repository offering a curated list of payloads and techniques specifically designed for web application security testing. It includes detailed documentation on various vulnerabilities and how to exploit them, alongside resources for tools like Burp Intruder. Notable features include structured chapters with vulnerability descriptions, applicable payloads, and a collection of methodologies for diverse security scenarios, making it an essential toolkit for penetration testers and security professionals.

PetitPotato is a local privilege escalation tool that leverages the PetitPotam technique by abusing impersonate privileges via the MS-EFSR protocol. Its primary use case is to gain SYSTEM privileges on target Windows systems by exploiting vulnerabilities in encrypted file system operations. Notable features include compatibility with the latest Windows versions and the ability to execute arbitrary commands by specifying the desired EfsID and command parameters.

Phanto is a Windows tool designed for privilege escalation by bypassing User Account Control (UAC) prompts, enabling malware execution on Windows 10 and 11 systems when an administrator account is compromised. Its primary use case is facilitating unauthorized access while concurrently removing indicators of compromise to conceal malicious activity. Notable features include its ability to execute without user consent and the functionality to erase traces post-execution.

pwncat is a versatile post-exploitation platform designed primarily for Linux targets, though it now includes alpha support for Windows. It enhances red team operations by automating interactions with remote shells, enabling functionalities like enumeration, implant installation, and privilege escalation. Notable features include the ability to spawn pseudo-terminals, synchronize shell environments, and streamline the management of remote connections for more efficient exploitation.

PYTMIPE is a Python 3 library that facilitates Windows token manipulation and impersonation for privilege escalation, allowing users to gain elevated access within Windows environments. The tool features various methods for managing tokens and privileges, including token creation, impersonation, and access to additional escalation techniques like parent PID spoofing and service management. Additionally, it provides capabilities to retrieve comprehensive information about selected tokens and supports both local and remote token operations.

Road To Hacking is a comprehensive guide designed for enthusiasts of Ethical Hacking, providing an extensive overview of widely used tools for penetration testing and auditing. Notable features include detailed instructions on tools such as Nmap for vulnerability detection, Metasploit for exploitation, and Aircrack-ng for cracking WPA/WPA2-PSK, among many others. This resource emphasizes practical usage, ensuring users have foundational knowledge in Linux and terminal commands to effectively utilize the tools presented.

The SELinux-Kernel-Module-Bypass tool enables users to bypass SELinux protections through the use of the `init_module` function, primarily aimed at security researchers and penetration testers. This project provides resources and methods for exploiting SELinux configurations, enhancing the understanding of kernel module behavior within constrained environments. Notable features include documentation and links to related resources for further exploration of Linux kernel module manipulation.

SUIDump is an automated tool for identifying potential privilege escalation vectors in Linux systems by analyzing setuid binaries. It leverages the GTFOBins database to assess known exploitation methods, allowing users to conduct both standard and verbose scans for security auditing purposes. Key features include automated discovery of SUID binaries, a customizable command-line interface, and handling of rate limiting for checks against GTFOBins.

#system3 is a tool designed to facilitate system shell access and the installation of system applications on Samsung devices, bypassing restrictions imposed by the One UI 5.1 SMT patch. It leverages the Factory Test Launcher to gain system UID privileges, enabling users to downgrade and install applications without encountering standard installation errors. Notable features include support for a wide range of Samsung devices and the ability to execute installations that are typically restricted, thereby restoring functionality for various system-level applications.

This repository provides a comprehensive list of methods to coerce Windows machines into authenticating to an attacker-controlled machine, leveraging vulnerabilities in the authentication process. It includes 15 tested functions across 5 protocols, with functionalities for communicating through distributed file systems and encrypting file systems, ultimately facilitating unauthorized access to resources. The tool is intended for penetration testing and security audits, enhancing the capabilities of security professionals in assessing Windows environments.

AKQ_0D_PE is a playful tool designed to simulate a Zero-day local privilege escalation exploit targeting a vulnerability in the Linux PipeFS subsystem. It demonstrates memory corruption techniques, ROP injection, and namespace traversal, all while providing an interactive root shell, but it is ultimately a prank and does not exploit a real vulnerability. The tool serves as an educational illustration of exploitation methodologies and is intended for demonstration purposes only.

The Fuck-Windows-Security script is a malicious tool designed to disable various Windows security features through registry manipulation, effectively bypassing User Account Control (UAC) and gaining elevated privileges. It implements an anti-virtual machine feature to ensure execution on actual systems, while also providing persistence through self-replication by copying itself to the startup folder. Notably, it disables numerous critical security aspects, including Windows Defender, Firewall, and system recovery options, allowing for potential exploitation of the target environment.

The IOCTL Linux Driver repository provides a foundational example for creating an IOCTL driver in Linux, enabling kernel mode access to special registers and memory-mapped regions for user mode applications. Notable features include an example application demonstrating driver interaction, a structured codebase with modular files for the driver and application, and debugging instructions utilizing printk output and strace for tracing user-kernel interactions.

AIO-Pentesting is a comprehensive resource for penetration testers, encapsulating various methodologies, tools, and commands necessary for conducting thorough security assessments. It categorizes content into phases, covering pre-intrusion and intrusion techniques for both Linux and Windows environments, along with additional materials such as notes for certifications like OSCP and OSWE. Notable features include organized documentation on common pentesting stages, forensics, and various exploitation techniques, as well as links to essential vulnerability databases and binary libraries.

The Archive is a continually evolving repository that curates hacking methodologies, cheatsheets, and conceptual breakdowns, specifically designed to be a human-curated alternative to the increasing reliance on LLMs. Its primary use case is to provide easily accessible, spell-checked information along with referenced content derived solely from clear-net sources. Notable features include the inclusion of alternative resources with descriptions, page differentiation for talk notes, and plans for future enhancements such as a public REST API for querying the data.

asroot is a utility designed to run specified commands with root user privileges after prompting for the user's password. It ensures a secure execution environment by sanitizing and updating environment variables, with an option to preserve the original environment. The tool is restricted to users in the wheel group, reinforcing access control measures for executing high-privilege commands.

The Awesome Windows Red Team repository is a comprehensive collection of resources tailored for Red Team professionals engaging in Windows environments. It encompasses a wide variety of materials including tools, books, courses, and techniques focused on topics such as Active Directory exploitation, lateral movement, privilege escalation, and defense evasion strategies. Notable features include structured categories for efficient navigation, making it suitable for users ranging from beginners to advanced practitioners.

The "benchmark-privesc-linux" tool provides a comprehensive benchmarking environment for testing Linux privilege escalation vulnerabilities, where a low-privilege user attempts to gain root access. It offers both virtual machine and Docker container setups for testing various single-step privilege escalation scenarios in an isolated manner, ensuring security and reproducibility. Key features include customizable vulnerability scenarios, support for running tests in both VMs and Docker, and complete open-source access for academic and experimental use.

Chronomaly is a kernel exploit targeting CVE-2025-38352, facilitating persistent root access on LG webOS Smart TVs running kernel version 5.4.268 on ARM64 architectures. It features an automated exploit chain that leverages novel techniques, including a redesigned write primitive and non-destructive pipe reads, ensuring reliability on physical hardware through advanced race condition manipulations. The exploit has been validated across multiple TV models and firmware versions, and was disclosed responsibly to LG's Security Researcher Program.

Cloud-audit-mcp is a cloud security auditing tool designed for AI agents to directly interact with cloud APIs, allowing for real-time checks, correlation of findings, and automated remediation of vulnerabilities. Unlike traditional tools that produce static reports requiring human analysis, this tool enables the AI to prioritize issues and generate specific commands for fixes, streamlining the security auditing process across multi-cloud environments such as AWS, Azure, and GCP. Notable features include the ability for the AI to chain checks, assess context, and follow up on remediation efforts without needing to re-scan the whole environment.

copyfail-detect is a detection toolkit designed to identify exploitation attempts of CVE-2026-31431, a local privilege escalation vulnerability in the Linux kernel that alters page-cache data without modifying the actual disk file. It features multiple detection layers, including real-time eBPF monitoring of suspicious activities, auditd rules for syscall tracking, and a page-cache comparison tool for post-exploitation analysis, enabling proactive defense and investigation against the vulnerability. The toolkit also provides mitigation scripts and documentation for responders to safely address incidents involving the Copy Fail exploit.

copyfail-rs is a cybersecurity tool that provides multi-vector proof-of-concept (PoC) exploitation and detection for CVE-2026-31431, specifically targeting vulnerabilities in PAM authentication systems. Its notable features include a unique PAM auth-bypass vector and a detection mechanism that identifies alterations in critical files that traditional file integrity monitoring solutions overlook, using a novel hashing approach that differentiates between actual disk state and memory cache mutations. This tool operates as a single static binary with no runtime dependencies, making it easily deployable across various Linux architectures.

copyfail-rs is a Rust implementation of the Copy Fail exploit (CVE-2026-31431), which demonstrates a local privilege escalation vulnerability on major Linux distributions by chaining the `AF_ALG` and `splice()` syscalls. This tool features a high-performance and memory-safe design, dynamic ELF payload construction, zero-copy exploitation for efficient interaction with the Linux kernel, and allows customization of commands to be executed with root privileges. It is intended strictly for educational and research purposes, focusing on understanding and mitigating similar vulnerabilities.

CredsHunter is a read-only credential discovery tool designed for authorized post-exploitation activities, efficiently identifying and extracting reusable credentials such as passwords, keys, and hashes while filtering out irrelevant cloud tokens. It operates through a structured five-stage process, scanning various OS credential stores and confirming the presence of valuable file types, ultimately delivering findings in a tiered format that prioritizes critical information. This tool supports both Linux and Windows environments, providing versatile and targeted scanning options without altering the host system.

This tool provides a Python-based exploit for the CVE-2024-32019 vulnerability in the Netdata Agent, specifically targeting the misconfigured `ndsudo` SUID binary that incorrectly handles the `PATH` environment variable. Its primary use case is for users with authorized access to demonstrate local privilege escalation (LPE) by executing a malicious binary with root privileges. Notable features include both manual and automated exploitation methods, aimed for educational purposes to assess potential risks in affected versions of the software.

CVE-2026-41089 is a critical cybersecurity tool designed to assess Windows Active Directory Domain Controllers for a severe unauthenticated remote code execution vulnerability caused by a stack-based buffer overflow in the Netlogon service. It allows users to execute crafted requests to identify susceptible systems without prior authentication, making it a crucial tool for detecting and mitigating potential exploits in enterprise environments. The tool features a Python-based script that facilitates various testing techniques, including baseline checks and aggressive payload testing, all while ensuring system stability.

Elewrap is a minimalistic setuid wrapper program designed for secure privilege elevation, operating similarly to sudo but with a focus on simplicity and reduced attack surface. It statically compiles auth rules, allowing the definition of which users and commands can utilize elevated permissions, and provides a NixOS module for seamless integration and deployment. Notable features include the ability to authenticate target commands via SHA512 hash and fine-grained control over allowed users, groups, and environment variables.

The repository titled "Fuck-Windows-Security" appears to be a tongue-in-cheek commentary rather than a functional cybersecurity tool. It does not provide a specific use case or notable features for any security-related applications.

Glass Cage is a zero-click exploit chain targeting iOS 18.2.1, leveraging vulnerabilities in image processing and WebKit to achieve remote code execution, privilege escalation, and persistent control over compromised devices. The attack is initiated through a malicious PNG transmitted via iMessage, triggering an automatic parsing process that exploits multiple CVEs, ultimately allowing root access and the ability to manipulate device state without user interaction. Notable features include its stealthy operation, the capacity for device bricking, and comprehensive access to sensitive data through keychain exfiltration.

Golden dMSA is a cybersecurity tool that facilitates the exploitation of delegated Managed Service Accounts (dMSAs) through the "Golden DMSA" attack, allowing unauthorized password generation for dMSAs offline. Key features include the ability to extract KDS Root keys, enumerate dMSA accounts, guess ManagedPasswordIDs, and generate valid passwords, making it a potent tool for penetration testing and security assessments of systems with vulnerabilities in dMSA authentication. The tool is built for .NET Framework 4.7.2 and includes functionalities for password conversion, information gathering on dMSAs and KDS keys, as well as brute force password attacks.

The Hacking Study Guide serves as a comprehensive resource for individuals preparing for cybersecurity certifications such as eJPT, PNTP, and OSCP. It encompasses essential topics including Windows and Linux privilege escalation, bug bounty techniques, and operational security intelligence (OSINT), providing checklists and detailed notes for practical learning. The tool is designed to enhance users' understanding of ethical hacking methodologies, enabling them to detect, prevent, and remediate security vulnerabilities effectively.

Invoke-SeRestoreAbuse is a privilege escalation tool that exploits the SeRestorePrivilege via Seclogon service hijacking to execute arbitrary commands with SYSTEM privileges. It achieves this by modifying the Seclogon service's ImagePath using SeRestorePrivilege and REG_OPTION_BACKUP_RESTORE techniques. This tool is designed for authorized system penetration testing and is accompanied by usage demonstrations.

Kosty is a comprehensive CLI tool designed for AWS cost optimization and security auditing, capable of scanning over 30 AWS services. Its key features include external attack surface mapping, IAM privilege escalation detection, and specific audits for GenAI workloads like Bedrock and SageMaker, alongside actionable insights on cost savings and security gaps. The tool facilitates organization-wide scanning with parallel processing and offers an interactive visual dashboard for in-depth report analysis.

The Offensive Security Forensics Portfolio is an educational repository showcasing practical skills in cybersecurity, particularly in forensic analysis, penetration testing, and vulnerability assessments. It features detailed documentation of various security techniques, including the implementation of Multi-Factor Authentication for SSH and memory forensics using the Volatility Framework, as well as threat hunting exercises with Splunk. This portfolio serves as a comprehensive example of applied offensive security methodologies within controlled environments.

Payloads All The Things is a comprehensive repository that provides a collection of useful payloads and techniques for web application security testing. It offers structured documentation on various vulnerabilities, including exploitation methods and payload examples, and is designed to assist penetration testers in identifying and utilizing attack vectors effectively. Notable features include templates for adding new vulnerabilities, integration with Burp Suite Intruder, and a community-driven approach to enhancing its content.

Pentest-Service-Enumeration (PSE) is a terminal-based tool designed for penetration testers, providing a quick-reference library of commands organized by service and enabling interaction with AI/LLM endpoints. Its primary use case is to facilitate service enumeration during penetration testing, while also incorporating fingerprinting and chat functionalities for AI services, aiding both practical application and certification preparation. Notable features include customizable command tracking, multi-technique extraction capabilities, and session isolation for enhanced security during testing operations.

The Pentesting-Methodology repository provides a structured approach to penetration testing, encompassing networking fundamentals, reconnaissance, and analysis techniques. It includes tools for identifying web servers and technologies, brute-forcing subdomains, and performing directory enumeration, making it useful for security professionals looking to streamline their penetration testing workflows. Notable features include detailed networking information and integration with various reconnaissance tools such as Sublist3r and Amass.

PrivHunterAI is a tool designed to identify unauthorized access vulnerabilities through passive proxying, utilizing various mainstream AI engines such as Kimi, DeepSeek, and GPT. The tool's notable features include support for HTTPS traffic detection, customizable request headers, and the ability to view scan results via both terminal and a web interface. It requires configuration of AI models and API keys, allowing for flexible integration and usage in vulnerability assessments.

rfxn-defense is a Linux defense tool that provides a responsive mitigation layer against local privilege escalation (LPE) vulnerabilities by deploying kernel-level protections as soon as new vulnerabilities are identified. It supports automatic updates every four hours and requires no system reboots to apply mitigations, currently covering seven LPE classes across two families, including various techniques such as `LD_PRELOAD` and `modprobe` interventions. This tool is designed for ease of installation and ongoing security management within environments running Enterprise Linux distributions.

Rootisnaked is an eBPF-based tool crafted for monitoring root privilege escalations on Linux systems by intercepting changes to user credentials, specifically monitoring when a process's UID changes to 0 (root). Primarily used for detecting potential privilege escalation attempts, it logs these events to a ring buffer, enabling subsequent analysis. The tool additionally supports centralized alerting via integration with Alertmanager and Telegram for real-time notifications.

SecOps-CLI Guides is a curated repository providing PDF command-line cheat sheets and how-to guides tailored for security professionals, facilitating offline reference for key cybersecurity tools and techniques. Notable topics include Metasploit, Nmap, SQLMap, and Active Directory attacks, making it a valuable resource for penetration testing and security operations. The repository invites contributions to expand its collection, enhancing its utility for the security community.

The tool addresses two high-severity privilege escalation vulnerabilities, CVE-2025-32463 and CVE-2025-32462, affecting the `sudo` utility in various Linux distributions, with a critical CVSS score of 9.3 for CVE-2025-32463. It emphasizes the risks associated with misconfigured `sudoers` rules, particularly those involving wildcard commands, and provides mitigation strategies such as immediate updates to the fixed version and careful audit of `sudoers` policies. Key features include vulnerability detection guidance and examples of secure configuration practices to prevent potential exploitation.

SUID3NUM is a standalone Python script designed to identify and exploit SUID binaries on Linux systems, distinguishing between default and custom binaries. Its primary use case is in penetration testing, particularly for scenarios like Capture The Flag (CTF) challenges, where it automates the exploitation of non-default SUID binaries while providing a clear overview of potentially exploitable binaries from the GTFO Bins repository. Notable features include the ability to auto-exploit custom binaries without impacting the system, as well as color-coded output for improved readability.

VulnOS: Chronos is a penetration testing lab designed to simulate a medium-difficulty hacking scenario, emphasizing skills in recon, web exploitation, pivoting, and privilege escalation. Noteworthy features include a step-by-step walkthrough that outlines methodologies such as utilizing tools like `nmap`, `gobuster`, and `hydra` for effective enumeration and exploitation, as well as creative techniques like exploiting a misconfigured upload filter for executing a PHP payload. Users can capture flags through various challenges, ultimately aiming to attain root access.

VulnOS "Legacy" Lab Walkthrough offers a structured environment for foundational penetration testing training, allowing users to engage in practical exercises like reconnaissance, enumeration, and privilege escalation. The lab features guided chapters that simulate real-world scenarios by employing tools such as Nmap and Gobuster, and emphasizes techniques for discovering services, hidden files, and exploiting SUID binaries for privilege escalation.

Windows Kernel - Exploration is a repository that provides a collection of notes, tools, and code snippets for exploiting Windows kernel drivers, aimed at both research and offensive security applications. It covers both legacy driver vulnerabilities and modern exploitation techniques, including Bring Your Own Vulnerable Driver (BYOVD) methods, while offering resources for kernel debugging, PDB analysis, and understanding core primitives related to kernel exploits. Notable features include detailed discussions on essential exploit techniques, kernel mitigations, and various tools for PDB parsing and debugging.

WindowsPrivilegeEscalationVulnerabilityDisplayBox is a Windows executable designed for detecting and demonstrating privilege escalation vulnerabilities for security research and educational purposes. Key features include the ability to modify PowerShell execution policies, take ownership of files, elevate privileges to SYSTEM or TrustedInstaller, and display current permissions of the program. This tool is strictly for demonstration and is best utilized in controlled environments.

The repository contains a collection of writeups detailing solutions and methodologies used in various Capture The Flag (CTF) competitions, including Hack The Box (HTB). Its primary use case is to provide insights and explanations for participants looking to learn from past challenges. Notable features include links to social media for support and engagement, as well as visual representation of stargazers over time.

Z-Jail is a lightweight multi-layer sandbox for executing native code on Linux, designed for scenarios such as CI pipelines and CTF challenges. It features seven ordered isolation layers that enforce security measures like namespaces, capability dropping, seccomp-BPF syscall whitelisting, and auditing with JSON logging, all within a compact ~81 KiB binary and without external dependencies. This makes Z-Jail a unique solution that balances minimalism and robust security for code execution environments.

LinPwn is an interactive post-exploitation tool designed for enumerating information and facilitating privilege escalation on compromised Linux machines. Key features include executing shells, reading files, running scripts like LinEnum.sh for enumeration, downloading files, and extracting system password hashes and saved Wi-Fi credentials. This tool is essential for security professionals conducting penetration tests to assess vulnerabilities post-exploitation.

Enumy is a high-performance enumeration tool designed for penetration testing and Capture The Flag (CTF) challenges, facilitating the identification of common security vulnerabilities on target Linux machines. Its features include configurable scan options, the ability to output results in various formats, and support for multithreaded operations to optimize scan speed and efficiency. Suitable for both professional pentesters and hobbyists, Enumy assists users in uncovering security issues during post-exploitation phases.

Leprechaun is a penetration testing tool that facilitates the identification of valuable targets within an internal network by aggregating netstat results from multiple hosts. Its primary use case involves analyzing network traffic connections to uncover potential vulnerabilities and traffic patterns, and it features command-line options to specify output files, ports of interest, and IP address types. Notable features include the ability to output detailed connection statistics organized by server and traffic destination ports, enhancing visibility for security assessments.

PEH (Post Exploitation Helper) is a script designed to facilitate the downloading of common post-exploitation tools onto a target machine with minimal commands. Its primary use case is to operate on machines lacking internet access, allowing users to specify tool files and network interfaces for resource acquisition. Key features include flexible file input, configurable network interface and port options, and straightforward usage through command-line commands.

TokenPlayer is a tool designed for manipulating and abusing Windows access tokens, focusing on the Win32 API. Its primary use case includes stealing and impersonating tokens, bypassing User Account Control (UAC) via token duplication, and creating new tokens for network authentication without elevated privileges. Notable features include the ability to execute applications under an impersonated context, spoof parent process IDs, and operate within non-interactive environments, making it suitable for various privilege escalation and security testing scenarios.

GTFOBins CLI is a command-line tool designed for security professionals to quickly access and search for Unix binary exploitation techniques. It features capabilities such as fuzzy searching, filtering exploitation types, and an interactive mode for ease of navigation, all while providing an offline database for fast, local access. The tool supports cross-platform usage and enhances readability with syntax highlighting, allowing for efficient identification of security bypass methods.

Searchbins is an offline command-line tool designed to search for GTFOBins binaries that allow users to bypass local security restrictions in misconfigured systems. Its notable features include the ability to enumerate specific binary functions, display commands to exploit those functions, maintain an up-to-date GTFOBins database, and allow for file-based binary searches. This tool serves as a valuable resource for security professionals to identify and utilize potential vulnerabilities in binary applications.

linux-priv-esc-audit is a Linux system auditing script designed to identify privilege escalation vulnerabilities and enhance security. It offers dual-mode operation for both root and low-privilege users, generates comprehensive audit reports with vulnerability insights, and provides user-friendly guidance throughout the audit process. Regular updates ensure the tool remains effective against new security threats and techniques.

Kubesplaining is an open-source command-line interface tool designed for Kubernetes security assessments, focused on analyzing privilege escalation paths within a live cluster or a snapshot. Unlike traditional scanners, it constructs a multi-hop RBAC privilege escalation graph that illustrates how non-system subjects can escalate their privileges to critical sinks, providing detailed remediation for each finding. Its outputs include prioritized reports in HTML, JSON, CSV, and SARIF formats, making it suitable for human review or integration into CI/CD workflows.

FUBAR is a terminal user interface (TUI) tool designed for offline payload generation, retrieval, and exfiltration, particularly in restrictive shell environments. It provides power users with access to thousands of payloads sourced from gtfobins, facilitating security research and privilege escalation operations. The tool features intuitive navigation through keybindings, payload copying capabilities, and is currently in prototype status with additional features planned for future implementation.

TryHackMe is a free cybersecurity learning path designed to advance users from novice to expert through a range of practical exercises, introductory Capture The Flag (CTF) challenges, and educational modules covering topics like OpenVPN, Linux fundamentals, web scanning, and Metasploit. This resource is suitable for both newcomers to the field and those looking to enhance their skills, and it culminates in a comprehensive foundation in cybersecurity, preparing users to address more complex challenges. Notable features include diverse content formats, hands-on labs, and accessible learning materials to foster practical experience in cybersecurity practices.

Anvil is a runtime-first tool designed for privilege escalation and attack surface assessment specifically targeting Windows thick client applications. It effectively reduces false positives by combining Procmon capture with Windows AccessCheck to validate writable paths in real-time while enforcing multiple verification gates. Notable features include its comprehensive approach to assessing various attack classes, detailed filtered analysis of candidate paths, and the ability to produce actionable reporting outputs in multiple formats.

wp-taint-scan is a specialized static analysis tool designed to detect genuine vulnerabilities in WordPress plugins using a native Go-based taint analysis engine. It enables users to scan multiple versions of plugins in parallel and offers features such as detailed source-to-sink dataflows, version diffs to track changes in vulnerabilities, and a thorough understanding of the WordPress security model, significantly reducing false positives. Notable vulnerability classes include SQL injections, XSS, path traversal, and missing authorization issues, making it an essential tool for enhancing WordPress security.

DLL Hijacking Vulnerability Scanner is a specialized tool for identifying DLL hijacking vulnerabilities within signed Windows executable files. It features automated scanning, DLL dependency analysis, and comprehensive filtering options, enabling security professionals to test executables for hijacking susceptibility and analyze their DLL loading behaviors, as well as generating detailed vulnerability reports.

Awesome Hacking & Cybersecurity Learning Path is a comprehensive resource designed to guide individuals from beginner to advanced levels in ethical hacking, penetration testing, and cybersecurity. It features curated materials on bug bounty hunting, OSINT tools, CTF challenges, and practical exercises for real-world scenarios, alongside essential concepts in networking and web application security. Notable features include detailed roadmaps for penetration testing, hands-on labs from platforms like TryHackMe and HackTheBox, and extensive coverage of privilege escalation techniques across multiple operating systems.

The Excalibra cybersecurity repository serves as a comprehensive educational resource designed to enhance skills in ethical hacking, penetration testing, and cybersecurity fundamentals. Key features include detailed sections on Open Source Intelligence (OSINT), the use of Nmap for network discovery and security auditing, insights into social engineering tactics, and guidance on employing Kali Linux, making it a valuable tool for individuals seeking a structured learning path in cybersecurity.

Gecko is a web backdoor tool designed to facilitate exploitation and control of compromised systems, primarily targeting web applications. It features functionality for bypassing various HTTP error responses, auto-rooting capabilities, and the ability to manage backdoors, admin accounts, and file handling operations. Notably, it includes a Backdoor Destroyer and supports both Linux Exploit Suggester functionality and user account modifications, making it a versatile tool for penetration testing and system administration.

emp3r0r is an advanced, zero-trust post-exploitation framework and command & control (C2) system designed for secure operations on both Linux and Windows environments. Its notable features include autonomous gossip mesh networking, fileless memory execution of Starlark-scripted agents, and robust cryptographic identity pinning, ensuring high levels of stealth, operational control, and security against impersonation attacks. The framework facilitates seamless integration and execution without relying on host-based interpreters, making it highly suitable for high-security scenarios.

Linemadpeas is a comprehensive Linux privilege escalation enumeration tool implemented in Bash, designed to thoroughly scan Linux systems for potential privilege escalation vulnerabilities. It offers a user-friendly interface, automatic detection of over 25 vulnerability categories, and detailed exploit methods with executable examples while generating two separate output files for enumeration reports and exploit strategies. This tool is particularly valuable for penetration testing, security auditing, and educational purposes in understanding escalation techniques.

RustPotato is a Rust-based privilege escalation tool that exploits DCOM and RPC to gain NT AUTHORITY\SYSTEM privileges on Windows systems. It features a TCP-based reverse shell utilizing Winsock APIs for remote command execution and employs indirect NTAPI calls to handle security tokens effectively. Its key capabilities include identifying and hijacking RPC communications, impersonating clients, and executing commands with elevated privileges.

The Potato Garden repository compiles various Windows privilege escalation tools, referred to as "Potatoes," each sourced from different open-source projects. Its primary use case is to provide security professionals with readily accessible binaries for testing and exploiting vulnerabilities within Windows environments. Notable features include the aggregation of multiple tools into a single collection, enabling streamlined access and use for penetration testing and security assessments.

EVA is an AI-driven penetration testing tool designed to aid users throughout the pentesting lifecycle with intelligent analysis, automated enumeration, and real-time vulnerability assessment. It features support for multiple AI backends, session management for persistent interactions, and an interactive interface for executing commands and analyzing results, thereby enhancing the efficiency of penetration testing efforts. This tool aims to assist, rather than replace, cybersecurity professionals by providing strategic guidance and quicker outcomes during engagements.

offsecnotes is a comprehensive web platform that aggregates notes and resources focused on offensive security and penetration testing methodologies. It encompasses various topics including Android, web application security, networking, and operating systems like Linux and Windows, providing essential concepts, exploitation techniques, and practical tools for security practitioners. Notable features include organized sections for different domains of security, making it a valuable reference for both beginners and experienced professionals.

CVE-2025-32463 is a privilege escalation exploit targeting vulnerable versions of sudo (1.9.14 to 1.9.17) that allows attackers to gain root access without requiring gcc to be installed on the target system. The tool includes pre-compiled payloads for various architectures, directly executing an exploit via scripts, making it notably convenient for users who may lack compilation tools. This exploit is intended solely for educational and authorized testing purposes.

The CVE-2025-32463_chwoot repository provides a proof-of-concept implementation to demonstrate the privilege-escalation vulnerability in the chroot feature of vulnerable versions of `sudo`. It includes a Docker environment to build and run an exploit that showcases how to gain root access in affected systems. Notable features include a Dockerfile for setting up the environment and a script that facilitates the execution of the exploit inside a container.

The CVE-2025-55182 Scanner & Exploiter tool is designed to detect and exploit a critical remote code execution vulnerability in specific versions of React Server Components. It features detection capabilities for scanning single or multiple targets, as well as an exploitation mode that provides an interactive shell and options for reverse shell execution. The tool supports proxy usage and allows for multi-threaded scanning to enhance performance.

SeTcbPrivilege Local Privilege Escalation (LPE) is a tool implemented in Go that leverages the SeTcbPrivilege privilege escalation technique to allow users to execute arbitrary commands with elevated permissions on Windows systems. Its primary use case is for gaining administrative access by manipulating service configurations, and it features automatic service deletion post-execution, with a manual clean-up option available. This tool provides a streamlined method for executing commands that would normally require higher privileges.

CVE-2025-27237 is a local privilege escalation vulnerability affecting the Zabbix Agent for Windows, which arises from OpenSSL configuration file hijacking due to hardcoded paths accessible to low-privileged users. This tool provides scripts and proof-of-concept (PoC) implementations to analyze affected Zabbix binaries, compile malicious DLLs, and facilitate exploitation in vulnerable systems, while also offering methods for detection and remediation. Key features include binary analysis tools and detailed documentation for ensuring system security against this identified vulnerability.

ForceAdmin is a malicious tool designed to create an infinite loop of User Account Control (UAC) prompts, compelling users to grant administrative privileges by overwhelming them with requests. It provides various script templates in formats such as batch, PowerShell, AutoHotkey, AutoIt, HTA, and VBScript, facilitating execution via PowerShell and bypassing antivirus protections. Notable features include no dependencies, dual architecture support for x86 and x64 systems, and a fileless execution method.

This repository provides a proof-of-concept for a Windows local privilege escalation exploit that combines a User Account Control (UAC) bypass with token duplication to elevate a process to SYSTEM-level privileges. It serves primarily for educational purposes, demonstrating key concepts of Windows security, such as token mechanics and process elevation, while employing techniques like registry manipulation and access token duplication to illustrate vulnerabilities in privilege management. Notably, the tool employs specific Windows APIs for process creation and token handling, highlighting potential attack vectors in a controlled environment.

CentralizedPotatoes is a repository that aggregates various privilege escalation exploits in the Windows operating system, known as "potato" exploits, which leverage impersonation privileges to elevate access from service accounts to system level. The tool categorizes and documents these exploits, ranging from Hot Potato to God Potato, thereby providing a comprehensive reference for cybersecurity professionals and penetration testers. Notable features include a chronological list of exploits with links to their respective implementations and guidance on prioritizing their use based on effectiveness.

Copy Fail is a cybersecurity tool designed to exploit CVE-2026-31431, a vulnerability affecting specific Linux distributions. Its primary use case is for security researchers and penetration testers to demonstrate and assess the impact of this flaw across various operating systems, including Ubuntu, Amazon Linux, RHEL, and SUSE. Notable features include compatibility with multiple Linux kernel versions and a comprehensive technical writeup for understanding the vulnerability's implications.

Copy Fail is a proof-of-concept tool designed to demonstrate a method for fully unprivileged containers to achieve node-level code execution on Kubernetes by exploiting the CVE-2026-31431 Linux kernel vulnerability. It leverages the shared image layers in container runtimes, allowing an unprivileged pod to corrupt binaries in a shared layer that are later executed by privileged DaemonSets, thereby achieving container escape. Notable features include validation on multiple cloud platforms (Alibaba Cloud, Amazon EKS, and Google GKE) and a comprehensive breakdown of the attack chain, which includes page-cache corruption, cross-container propagation, and privileged execution.

CopyFail is a Python-based exploit tool targeting the CVE-2026-31431 vulnerability, which allows local privilege escalation on vulnerable Linux kernels (4.11 to <6.18). It utilizes the AF_ALG socket interface bug to enable unprivileged users to overwrite setuid binaries, bypassing race conditions and kernel-specific offsets, making it applicable across various distributions. Key features include the ability to check system vulnerability status, a simple execution process, and container escape capabilities, all while being an educational tool intended for authorized testing only.

CVE-2026-31431-CopyFail is a local privilege escalation exploit targeting a vulnerability in the Linux kernel's AF_ALG crypto subsystem, allowing an unprivileged user to perform a 4-byte arbitrary write in the kernel's page cache. The tool offers multiple exploitation methods, including dynamic ELF entry point overwrites and full binary replacements, with compatibility for both Python 2 and 3. Notable features include determinism without race conditions, operation within default Docker containers, and independence from kernel version, making it applicable across all kernels since 2017.

The CVE-2026-31431-Linux-Copy-Fail tool is a Rust-based local privilege escalation exploit that leverages an arbitrary page cache write vulnerability in Linux systems. It facilitates the execution of customizable shellcode, including a Meterpreter payload, and offers functions for testing vulnerability and executing exploits. Notable features include support for direct payload substitution and detailed usage instructions for compiling and executing the tool on affected Linux distributions.

Dirty Frag is a proof-of-concept tool that demonstrates how an unprivileged Kubernetes Pod can exploit the Dirty Frag vulnerability (CVE-2026-43284) to achieve node-level code execution on Amazon EKS by corrupting in-memory cached pages of shared container image layers. Its primary use case is to illustrate the risks associated with privileged DaemonSets in Kubernetes clusters that share image layers, as it allows for direct execution of compromised binaries by these privileged workloads. Notable features include the ability to target any privileged DaemonSet, leveraging kernel page-cache corruption alongside the sharing of image layers, thereby exposing a significant security vulnerability in Kubernetes environments.

dirtyfrag-arm64 is an ARM64/AARCH64 exploit tool adapted from the original x86_64 dirtyfrag PoC, targeting vulnerabilities CVE-2026-43284 and CVE-2026-43500. Its primary use case is for privilege escalation by corrupting system binaries, specifically employing an ESP path for exploitation due to limitations on the ARM64 architecture. Notable features include detailed analysis of AppArmor bypass methods and architecture-specific payload adaptations, allowing it to interact with existing user and network namespaces on vulnerable systems.

HatSploit is a modular penetration testing framework designed for writing, testing, and executing exploit code. Its primary use case is to facilitate security assessments and vulnerability exploitation in a structured manner. Notable features include its extensibility through modules and a user-friendly interface for deploying exploits.

The Linux-Exploitation repository provides a comprehensive set of tools and techniques for performing privilege escalation on Linux systems. Its primary use case is to assist security professionals in identifying vulnerabilities that can be exploited to gain higher access levels, featuring sections on manual enumeration, automated tools, password mining, misconfiguration exploitation, and maintaining access through SSH key uploads. Notable features include detailed guides on various escalation methods, scripts for automated enumeration, and an exhaustive list of potential exploits tailored for Linux environments.

The SNEK Blue War Hammer is a research tool that facilitates the exploration of Windows Defender's update mechanisms and potential vulnerabilities through sophisticated Windows API interactions. It is primarily aimed at security researchers and system administrators for educational purposes, implementing advanced features such as RPC communication, COM interfaces, VSS manipulation, and kernel-level file system operations. Notably, it allows for the extraction and analysis of Defender update packages directly from Microsoft, highlighting attack vectors associated with file access controls during the update process.

Copy Fail is a cross-platform implementation in C of the Copy Fail Linux Local Privilege Escalation (LPE) exploit (CVE-2026-31431), designed to demonstrate the vulnerability on various architectures without relying on per-architecture hex blobs or inline assembly. The tool includes multiple variants for payload delivery, such as a binary-mutation dropper and a variant that modifies the `/etc/passwd` file, as well as a non-destructive vulnerability checker. It requires no additional libraries and supports extensive architecture compatibility through the included nolibc.

CVE-2025-32463 is a Go-based exploit tool designed to exploit a critical local privilege escalation vulnerability in sudo versions 1.9.14 to 1.9.17. The tool manipulates the `--chroot` option to load a malicious shared library, allowing unauthorized users to gain root access. Notable features include the ability to run the exploit in both normal and silent modes, and it supports building from source or using a pre-built binary.

The Linux LPE Toolkit is a multi-architecture privilege escalation tool designed to identify and exploit vulnerabilities to gain root access on Linux systems. It includes 24 pre-built exploits for various architectures, automatically detects kernel versions, filters out patched exploits, and attempts each exploit until root access is achieved. Notable features include a dry-run mode for planning, command execution upon successful exploitation, and options for verbose or silent output during exploitation.

ttyinject-rs is a tool that exploits the `TIOCSTI` ioctl in the Linux kernel to inject keystrokes into a terminal, allowing a non-privileged user to gain root privileges when the root user executes `su - user`. Notable features include its easy integration with a user's `~/.bashrc`, its self-deleting behavior post-execution, and compatibility with specific Linux kernel configurations. It serves primarily as a demonstration of an exploit for educational purposes.

RootHunter is an offensive auditing suite for Linux, designed for pentesters and administrators to detect and prioritize common privilege escalation vectors before malicious actors can exploit them. It includes a Bash script for evidence collection, a local database of binary escalation techniques, and a Python analysis tool that generates actionable insights based on the collected evidence. Key features include a structured JSON report, prioritization of attack paths, and integration with CVE databases for context-specific exploits.

The Offensive Security & DevSecOps Cheat Sheet is an interactive command reference designed for penetration testing and DevSecOps practices, featuring over 5040 commands organized into 53 categories and available in both English and Turkish. Notable features include a fully local operation with no telemetry, a fuzzy command palette for efficient searching, and the ability to add and manage personalized commands and profiles. It also integrates with MITRE ATT&CK tags for over 1,160 offensive commands, providing contextual security mapping and enhancing the tool's functionality for security professionals.

DLLHijackHunter is an automated detection tool designed for identifying, validating, and confirming DLL hijacking opportunities on Windows systems. It employs a multi-phase approach that includes discovery of exploitable binaries, filtration of false positives, and the deployment of a harmless canary DLL for verification, providing a comprehensive scoring and reporting mechanism. Notable features include extensive coverage of various hijack types, UAC bypass discovery, and a focus on corroborating potential attack paths with actionable intelligence.

The OSCP / OSCP+ Cheatsheet serves as a comprehensive penetration-testing reference specifically designed for the 2026 OSCP+ exam, organizing critical information across various attack phases. Users can efficiently navigate through self-contained modules covering reconnaissance, footholds, privilege escalation, and Active Directory exploitation, making quick lookups feasible during the exam without internet access. Notable features include clear exam strategy guidelines, restrictions on tool usage, and offline operation recommendations, ensuring candidates can reference essential tactics under exam conditions.

PrecompiledBinaries is a curated repository of precompiled binaries designed for use in authorized security testing, including penetration testing, red teaming, and exploit validation. It facilitates rapid access to essential tools across various scenarios such as privilege escalation, Active Directory assessments, and tunneling, eliminating the need for time-consuming compilation from source. Notable features include an organized layout of binaries by tool and platform, covering a wide range of use cases in security assessments.

Shells-X is a modular web shell framework designed for authorized penetration testing and security research, allowing users to deploy a single-file shell that incorporates various tools for executing commands, interacting with databases, and scanning ports. Its notable features include customizable builds with unique SHA256 fingerprints, an interactive environment for PHP and SQL commands, robust system diagnostics, and encrypted traffic handling. The framework also supports automatic detection of CMS/frameworks and provides a one-click export option for recon data to Faraday.

WinPrivEsc is a Windows enumeration and privilege escalation discovery toolkit designed for authorized testing. It offers two script variants—one using cmd for stealth on monitored hosts and another using PowerShell for more comprehensive analysis, allowing users to assess escalation vectors while maintaining a read-only operation. Notable features include customizable noise levels for the script output and extensive reporting on system configurations, user accounts, and permissions, ensuring flexibility and adaptability to various security environments.

The HTB Writeups repository is a comprehensive resource for Hack The Box enthusiasts, providing structured and searchable documentation for over 500 machines, 400 challenges, and various tools and methodologies useful for penetration testing and certification preparation. Notable features include an interactive machine finder, knowledge graph for technique exploration, and visual attack paths that illustrate complete exploitation processes. This repository serves as an essential hub for skill development aimed at OSCP, CPTS, and other security certifications.

The Certificate of Compromise repository contains a comprehensive paper detailing offensive operations against Active Directory Certificate Services (ADCS). It serves as a living document that outlines various attack techniques, their detection, and mitigation strategies, and is continuously updated to reflect new findings and community contributions. Notably, it emphasizes the dynamic nature of ADCS research, providing insights into attack taxonomies and the related challenges in securing these services.

HydraSoft is an advanced open-source tool designed for detecting DLL hijacking vulnerabilities within Windows environments, facilitating privilege escalation. It automates the analysis of executable files and their associated DLLs by scanning directory structures and import tables, thus identifying specific hijacking opportunities. Notable features include a real-time graphical user interface for centralized endpoint management and a color-coded rating system to prioritize targets based on the complexity of crafting proxy DLLs.

suidPWN is a tool designed to streamline the identification of SUID binaries that may facilitate local privilege escalation (LPE) on a target system. By allowing users to input the output of the `find` command, it quickly checks against gtfobins for vulnerabilities, efficiently surfacing potential escalation techniques and storing them locally for subsequent use. Notable features include the ability to scrape data from gtfobins automatically and the option to regularly update the binary reference files.

One-Lin3r is a lightweight and modular framework designed for penetration testers, providing over 176 automated one-liners for tasks such as reverse shells, privilege escalation, and remote command execution across multiple operating systems. Notable features include advanced auto-completion for commands, typos correction, and the ability to execute multiple commands simultaneously, significantly enhancing efficiency during security assessments. The tool further simplifies command usage and management with clipboard integration and history tracking capabilities.

SYSTEMatic is a proof-of-concept tool designed for Windows that enables privilege escalation from a local Administrator account to the NT AUTHORITY\SYSTEM account via token impersonation, without UAC prompts or external dependencies. It leverages the Win32 API to duplicate a SYSTEM process's token and spawn new processes, making it valuable for system administration, security research, and penetration testing tasks. Notably, it operates solely within the constraints of existing Administrator privileges and does not exploit vulnerabilities or function as a UAC bypass.

GTFONow is a Python-based tool designed for automatic privilege escalation on Unix systems by exploiting misconfigured setuid/setgid binaries, capabilities, and sudo permissions. With a focus on usability for both CTF challenges and real-world pentesting scenarios, it offers various automated exploitation techniques, including file read/write primitives and SSH key theft. The tool is lightweight, compatible with multiple Unix variants, and requires no third-party dependencies, making it easy to deploy via a single script.

The HTB / THM / OSCP Master Penetration Testing Checklist is a comprehensive, modular framework designed to guide penetration testers through the phases of engaging with Hack The Box, TryHackMe, and OSCP-level machines. Key features include structured sections from setup and reconnaissance through exploitation and post-exploitation activities, as well as a quick reference for tools, commands, and troubleshooting. This checklist serves as a valuable resource for both beginners and intermediate practitioners in the penetration testing field.

SKELETONKEY is a comprehensive Linux local privilege escalation (LPE) tool that consolidates 46 modules targeting 41 distinct CVEs from 2016 to 2026, offering both red team and blue team functionalities. It features verified exploits, automatic module selection based on safety, detection rules for security audit logging, and a scanning capability for system administrators to identify unpatched vulnerabilities. This tool is designed for authorized testing only, ensuring ethical hacking practices while providing robust functionality for pentesters and system administrators alike.

This repository provides a curated collection of detailed writeups on various cybersecurity challenges, including Bug Bounty, Hack The Box (HTB), TryHackMe, and Capture the Flags (CTFs). It serves as an educational resource for cybersecurity practitioners at all levels, featuring in-depth explanations of techniques for web exploitation, privilege escalation, and more, aimed at enhancing understanding of vulnerabilities and methodologies in cybersecurity.

Roothound is a tool designed for local Linux privilege escalation, providing users with a clear graphical representation of pathways from a low-privilege shell to root access. It features an attack-path graph that illustrates each potential route, confidence coloring to indicate the reliability of paths, and copy-ready abuse commands for user convenience. The tool operates offline, requires no dependencies, and can generate self-contained HTML reports from LinPEAS output, making it suitable for authorized security testing and educational purposes.

Toboggan is a post-exploitation tool that facilitates a semi-interactive shell on both Linux and Windows targets via Remote Code Execution (RCE) methods. It operates by allowing users to define custom command execution logic through a simple Python interface, enabling interaction with command outputs even in restrictive network environments. Key features include support for Python-based execution modules, an interactive shell with command history, and the ability to establish communications using named pipes when reverse shells are not feasible.

ADscan is a comprehensive Active Directory pentesting tool designed for Linux environments that consolidates 103 attack techniques into a streamlined CLI interface. Its primary use case lies in automating the penetration testing process for red teamers and security professionals, providing capabilities such as enumeration, Kerberoasting, and attack-path analysis without the need for Windows. Notable features include fully automated scans through the 'adscan ci' command, which allows for both authenticated and unauthenticated assessments while leveraging Docker for its operational environment.

LinEnum-ng is a targeted, stable enumeration script designed for Linux privilege escalation, particularly suited for OSCP examinations. Its notable features include kernel CVE detection for various exploits, comprehensive checks for SUID and sudo vulnerabilities with GTFOBins integration, as well as support for container escape assessments in Docker and Kubernetes environments. The output is structured and color-coded for efficient triaging, minimizing information overload.

pSlip is a comprehensive security scanning tool for Android applications, designed to detect cryptographic vulnerabilities, OAuth implementations, and manifest issues using a streamlined HTML reporting engine. Its notable features include a powerful searchable HTML report leveraging a field-scoped query language, structured extraction and export of recovered key material and secrets, and a user-friendly interface that supports rapid identification of findings without requiring Java dependencies. The tool optimizes scanning performance and minimizes false positives, enhancing the efficiency of mobile application security assessments.

RedTeam/Pentest notes and experiments tested on several infrastructures related to professional engagements.

A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.

A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.

A collection of hacking / penetration testing resources to make you better!

A curated list of awesome privilege escalation

一个攻防知识库。A knowledge base for red teaming and offensive security.

Windows 权限提升 BadPotato

📦 Make security testing of K8s, Docker, and Containerd easier.

A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 12 methods.

Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 99.4% in KernelCTF images.

Docker Enumeration, Escalation of Privileges and Container Escapes (DEEPCE)

An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.

A sugared version of RottenPotatoNG, with a bit of juice, i.e. another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM.

K8工具合集(内网渗透/提权工具/远程溢出/漏洞利用/扫描工具/密码破解/免杀工具/Exploit/APT/0day/Shellcode/Payload/priviledge/BypassUAC/OverFlow/WebShell/PenTest) Web GetShell Exploit(Struts2/Zimbra/Weblogic/Tomcat/Apache/Jboss/DotNetNuke/zabbix)

My proof-of-concept exploits for the Linux kernel

Linux privilege escalation auditing tool

A collection of links related to Linux kernel security and exploitation

Linux enumeration tool for pentesting and CTFs with verbosity levels

linuxprivchecker.py -- a Linux Privilege Escalation Check Script

《Linux提权方法论》

Metarget is a framework providing automatic constructions of vulnerable infrastructures.

Cover your tracks during Linux Exploitation by leaving zero traces on system logs and filesystem timestamps.

MSDAT: Microsoft SQL Database Attacking Tool

ODAT: Oracle Database Attacking Tool

Collection of things made during my OSCP journey

Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor

A collection of Windows, Linux and MySQL privilege escalation scripts and exploits.

Privilege Escalation Enumeration Script for Windows

This cheasheet is aimed at the CTF Players and Beginners to help them understand the fundamentals of Privilege Escalation with examples.

Monitor linux processes without root permissions

Autonomous Privilege Escalation using AI

A tool designed to exploit a privilege escalation vulnerability in the sudo program on Unix-like systems. It takes advantage of a specific misconfiguration or flaw in sudo to gain elevated privileges on the system, essentially allowing a regular user to execute commands as the root user.

:arrow_up: :skull_and_crossbones: :fire: Automatic Linux privesc via exploitation of low-hanging fruit e.g. gtfobins, pwnkit, dirty pipe, +w docker.sock

WADComs is an interactive cheat sheet, containing a curated list of offensive security tools and their respective commands, to be used against Windows/AD environments.

Windows Local Privilege Escalation Cookbook

Automation for internal Windows Penetrationtest / AD-Security