T3nb3w

ComDotNetExploit. A C++ proof of concept demonstrating the exploitation of Windows Protected Process Light (PPL) by leveraging COM-to-.NET redirection and reflection techniques for code injection. This PoC showcases bypassing code integrity checks and loading malicious payloads in highly protected processes such as LSASS. Based on research from James Forshaw.

BITSCOMClient. This project is a C++ application that demonstrates how to download files using the Background Intelligent Transfer Service (BITS) via the Component Object Model (COM).

CreateProcessFromIShellDispatchInvoke. Alternate ways to create process through COM via IDispatch interface.

CMSTPLUA_UAC_ByBy. Windows UAC bypass via undocumented ICMLuaUtil COM interface (Medium IL → High IL).

FileCop. This tool demonstrates how to bypass User Account Control (UAC) to copy files into protected directories that normally require administrative privileges.

AsepPersist. AutoStart is a Windows persistence proof-of-concept that demonstrates how a program can survive reboots and logoffs using only legitimate, documented Win32 APIs.

TokenTheft. This tool demonstrates privilege escalation from Administrator (High Integrity) to NT AUTHORITY\SYSTEM by duplicating and impersonating process tokens.

AWS-Federation-Console-Login. PowerShell script to generate a federated AWS Management Console login URL using temporary credentials.