Open-source alternatives to Windows Kernel Exploits

Another Windows Local Privilege Escalation from Service Account to System

This project is a set of specialized utilities for Windows vulnerability assessment and patch management auditing. It functions as a vulnerability scanner and exploit suggester that analyzes installed updates to identify missing security patches and their corresponding known vulnerabilities. The system distinguishes itself by matching missing updates against a consolidated vulnerability database to recommend specific publicly available exploits. It maintains accuracy by synchronizing remote security bulletins into a local database and cross-referencing identified gaps against official update

LinEnum is a suite of security utilities for auditing Linux systems, scanning for privilege escalation paths, and enumerating local vulnerabilities. It functions as a system security audit tool, a local enumeration utility, and a scanner for identifying misconfigurations that could allow a user to gain root access. The project includes specialized auditing for containerized environments, specifically detecting Docker and LXC signatures to identify potential escape vectors to the host system. Its broader capabilities cover the analysis of kernel versions, the identification of SUID binaries a

PEASS-ng is a Linux privilege escalation scanner and post-exploitation enumeration tool. It identifies security vulnerabilities and misconfigurations on Linux systems that could lead to unauthorized elevated access. The tool functions as a security audit utility that discovers system weaknesses and sensitive information after initial access is gained. It scans operating systems to identify specific privilege escalation paths. Findings are converted into structured security audit reports. The tool supports exporting scan results into JSON, HTML, and PDF formats for formal analysis and documen

Next-Generation Linux Kernel Exploit Suggester

A list of public penetration test reports published by several consulting firms and academic security groups.

A collection of awesome penetration testing resources, tools and other shiny things

This is a webshell open source project

SecLists is a centralized library of security assessment data designed to support vulnerability discovery and penetration testing. It functions as a comprehensive repository of wordlists, payloads, and testing methodologies used to audit software, firmware, and internet-connected hardware for technical vulnerabilities. The project distinguishes itself through a standardized taxonomy and a language-agnostic data format, which allows security tools to predictably ingest and utilize its assets regardless of the underlying programming environment. By decoupling raw testing data from execution log

This project is a comprehensive, community-sourced knowledge base designed for security professionals and researchers. It functions as a centralized repository of offensive security techniques, providing a structured collection of exploit payloads, attack vectors, and methodologies for conducting vulnerability assessments and penetration testing. The repository distinguishes itself through a cross-platform payload taxonomy that categorizes exploitation methods by vulnerability type and target environment, enabling rapid lookup during security assessments. It maintains high standards of data i

MimiPenguin is a Linux memory credential extractor and password recovery tool designed to isolate and retrieve cleartext user login passwords from active process memory. It functions as a post-exploitation utility for extracting sensitive credentials from desktop user sessions during security assessments. The tool performs Linux memory forensics by analyzing system process memory to identify and isolate credentials. It is used for security penetration testing and evaluating risks associated with memory-based attacks, as well as testing for local privilege escalation. The system targets user-

Windows-Exploit-Suggester is a security audit tool designed to scan Windows systems for outdated components and missing security patches. It functions as a vulnerability scanner that compares target patch levels against official vendor security bulletins to identify security gaps. The tool specializes in exploit mapping, linking identified missing updates to known public exploit code and available penetration testing modules. It automates the research process by cross-referencing missing patches with specific vulnerability identifiers to determine applicable attack vectors. The system includ

This project is a security auditing tool and vulnerability scanner designed to evaluate the security posture of Linux hosts. It functions as a privilege escalation auditor that scans running kernels for missing security patches and vulnerabilities to identify potential paths for gaining root access. The utility performs kernel security analysis by matching system version strings against a database of known exploits. It audits kernel hardening settings and evaluates system exposure to categorize the probability of successful privilege escalation attacks. The tool covers a broad range of asses

This project is a proof of concept implementation for CVE-2026-31431, serving as a local privilege escalation tool for the Linux kernel. It functions as an exploit that allows a standard user account to obtain root permissions. The tool demonstrates a kernel page cache attack, where root access is achieved by writing shellcode into the cached pages of a privileged binary. This process manipulates how the Linux kernel handles page caches to execute code with elevated permissions. The repository covers areas of Linux security research, including kernel memory corruption analysis and local priv

PrivescCheck is a PowerShell-based security auditing tool designed to scan Windows configurations for potential privilege escalation paths and local host vulnerabilities. It functions as a vulnerability assessment utility that analyzes system settings and registry configurations to identify weaknesses that could allow unauthorized administrative access. The tool automates internal security reconnaissance and post-exploitation data collection to gather environmental information. It serves as a security compliance reporter by exporting scan results into structured formats, including HTML, CSV,

A tool that detects the privilege escalation vulnerabilities caused by misconfigurations and missing updates in the Windows operating systems. dazzleUP detects the following vulnerabilities.

UACME is a set of specialized tools designed to audit security configurations, escalate user privileges, and circumvent access control restrictions on Windows systems. It functions as a utility for executing commands with elevated privileges by bypassing User Account Control restrictions. The project includes a configuration auditor used to extract and analyze system settings to identify security misconfigurations and vulnerabilities. It provides a collection of techniques for gaining administrative rights on a host. The toolset covers a wide range of privilege escalation and security auditi

Exploitation paths allowing you to (mis)use the Windows Privileges to elevate your rights within the OS.

Simple wrapper around some of the features of Rubeus and KrbRelay (and a few other honorable mentions in the acknowledgements section) in order to streamline the abuse of the following attack primitive:

Active Directory Assessment and Privilege Escalation Script

CVE-2021-4034 1day