v4bel/januscapeKVM/x86 guest-to-host escape exploit (CVE-2026-53359) leveraging a use-after-free in shadow MMU emulation. Includes PoC for triggering host kernel…
seanheelan/anamnesis-releaseEvaluation framework for studying LLM agents that automatically generate working exploits from vulnerability reports, bypassing modern security…
v4bel/zapscapePoC exploit for CVE-2026-64561, a KVM/x86 shadow MMU use-after-free enabling guest-to-host escape with kernel root code execution on the host.
synacktiv/windows_kernel_shadow_stackProof of concepts demonstrating some aspects of the Windows kernel shadow stack mitigation.
hackspeak/cve-2026-64561Zapscape (CVE-2026-64561) KVM/x86 shadow MMU UAF guest-to-host escape PoC mirror — V4bel/@v4bel, MIT; for authorized security testing
d4yon/cve-2021-36934-hivenightmare-labEducational lab demonstrating CVE-2021-36934 (HiveNightmare) - Windows LPE via shadow copy ACL misconfiguration.
nu11secur1ty/0Exploit for a Windows Defender race condition that escalates to SYSTEM via use-after-free, crashes MsMpEng.exe, spawns a hidden shell, and persists…
typeconfused/cve-2020-17382CVE-2020-17382 Windows 10 x64 2004 Build 19041.264 Exploit
joelgmsec/autordpwnThe Shadow Attack Framework
hameda2/zydraMulti-threaded password recovery tool for RAR, ZIP, PDF, and Linux shadow files using dictionary and brute-force methods with configurable character…
owasp-noir/noirHunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
cyberark/aclightA script for advanced discovery of Privileged Accounts - includes Shadow Admins
eladshamir/whiskerWhisker is a C# tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively…
shutdownrepo/pywhiskerPython version of the C# tool for "Shadow Credentials" attacks
pshlyundin/ldap_shellInteractive shell for Active Directory enumeration and ACL abuse via LDAP/LDAPS. Supports DCSync, RBCD, Shadow Credentials, password changes, and…