Razz

PolyEngine. PolyEngine is an evasive PE packer designed for CTF challenges and low-level Windows security education. It focuses on bypassing EDR and AV heuristics through a layered stack of in-memory execution and obfuscation techniques.

MalDev. Collection of Windows loaders

Plutus-dogecoin. An automated bitcoin wallet collider that brute forces random wallet addresses

CVE-2021-43936. CVE-2021-43936 is a critical vulnerability (CVSS3 10.0) leading to Remote Code Execution (RCE) in WebHMI Firmware.

CVE-2021-43857. Gerapy prior to version 0.9.8 is vulnerable to remote code execution. This issue is patched in version 0.9.8.

CVE-2017-12617. CVE-2017-12617 is a critical vulnerability leading to Remote Code Execution (RCE) in Apache Tomcat.

Invoke-Knockout. A DLL library built to bypass AMSI and ETW. Also can be used directly with PS script.

RazorC2. RazorC2 is a Command & Control server made in ASP NET Core 8 with Razor Pages

SharpRecycledGate. RecycledGate implementation in C#

Plutus-Ethereum. Python

GetSystemPriv. Application for token duplication running chosen local executable file, downloading one from given URL or by running command.

CVE-2021-43798. CVE-2021-43798 is a vulnerability marked as High priority (CVSS 7.5) leading to arbitrary file read via installed plugins in Grafana application.

CVE-2022-27434. UNIT4 TETA Mobile Edition 29HF13 was discovered to contain a SQL injection vulnerability via the ProfileName parameter in the errorReporting page.

RTOVMSetup. Shell

keys. :key: Cryptocurrency private keys

CRS-RCE-Exploit. Car Rental System 1.0 suffers from SQL Injection on administrator login page and unsecure upload mechanism allowing to upload malicious files. This allows unauthenticated user to obtain reverse shell to server.

SharpFreshGate. C# implementation of FreshyCalls

COAE-Forge. Local AI Playground to learn offensive and defensive machine learning. Designed to expand basics and explain topics on ML from COAE course from HackTheBox.