Aleksey Pastukhov

SilentMoonwalk. PoC Implementation of a fully dynamic call stack spoofer

nightmare. Python

poc-archive. A structured archive of Proof-of-Concept security research, organized by category with metadata, reproduction steps, and references.

HiveOracle. Raw NTFS volume oracle: locked-file read and offline SAM hashes without LSASS

publications. Publications from Calif

Offensive-COM. Research notes on Windows Component Object Model (COM) attack surface for offensive security and vulnerability research. Covers COM hijacking, elevation of privilege, DCOM lateral movement, and persistence primitives with exploitation steps. Notes were generated by Kimi K3 Swarm may contain inaccuracies.

win32. Public mirror for win32-pr

CVE-2026-54992-PoC. Proof of concept for CVE-2026-54992, an MSMQ remote-read integer overflow

Mindmap. This repository will contain many mindmaps for cyber security technologies, methodologies, courses, and certifications in a tree structure to give brief details about them

Hells-Hollow. Hells Hollow Windows 11 Rootkit technique to Hook the SSDT via Alt Syscalls

WindowsRootkitsGuide.

XeraLdr. A stealthy and modular Windows loader designed to bypass modern EDR solutions using Module Stomping, Stack Duplication, and Advanced Sleep Obfuscation.

CVE-2026-26128. PoC for exploiting CVE-2026-26128.

GhidraMCP. MCP Server for Ghidra

bad-epoll.

win32k-callback-detouring. Abusing the win32k.sys kernel callback mechanism for arbitrary code execution

nocrt0. Custom C startup code for GCC/MinGW

InsideOLE. Companion code for Inside OLE 2nd Edition, published in 1995

darknet-mcp-server. 66-tool MCP server for dark web intelligence — breach data, ransomware tracking, Tor .onion access, malware analysis, blockchain intel, exploit search, stealer logs

BamExtensionTableHook. Proof-of-concept kernel driver that hijacks the Windows kernel extension table mechanism to preserve process notify callbacks even when attackers disable standard process notify callbacks.

Best-Books-for-Learning-Lisp-Programming. "Truth can only be found in one place: the code." ― Robert C. Martin

chrispe. ChirsPE is a experimental PE project built upon PEBakery's wim handling capabilities.

PseudoForge. An IDA Pro / Hex-Rays plugin that turns noisy pseudocode into reviewable, kernel-aware cleanup artifacts