Escalating Privileges via Third-Party Windows Installers
https://www.mandiant.com/resources/blog/privileges-third-party-windows-installers

https://github.com/mandiant/msi-search

GIUDA - Ask a TGS on behalf of another user without password
https://github.com/foxlox/GIUDA

KRBUACBypass

By adding a KERB-AD-RESTRICTION-ENTRY to the service ticket, but filling in a fake MachineID, we can easily bypass UAC and gain SYSTEM privileges.

Research:
https://www.tiraniddo.dev/2022/03/bypassing-uac-in-most-complex-way.html

Source:
https://github.com/wh0amitz/KRBUACBypass

It's a tool to interact with remote hosts using the Windows Search Protocol and coerce authentication. The target host will connect over SMB to the listener host using the machine account.

https://github.com/slemire/WSPCoerce

Proof of Concept for CVE-2023-38646

This vulnerability has been declared as critical, because it allows an unauthenticated attacker to execute arbitrary commands with the same privileges as the Metabase server. This vulnerability means the Metabase server can become a potential entry point for malicious attacks, which could compromise the integrity of the whole system it operates on.

https://github.com/Zenmovie/CVE-2023-38646

100 Methods for Container Attacks(RTC0010)
https://redteamrecipe.com/100-Method-For-Container-Attacks/

TBBRAT - this is power full BotNet

https://github.com/StayBeautiful-collab/TBBRAT

Diving into Windows Remote Access Service for Pre-Auth Bugs

https://i.blackhat.com/BH-US-23/Presentations/US-23-YukiChen-Diving-into-Windows-Remote-Access.pdf

This allows you to spoof emails from any of the +2 Million domains using MailChannels. It also gives you a slightly higher chance of landing a spoofed emails from any domain that doesn't have an SPF & DMARC due to ARC adoption.

https://github.com/byt3bl33d3r/SpamChannel

CVE-2023-36874: Windows LPE

https://github.com/Wh04m1001/CVE-2023-36874

Cross Platform Telegram based RAT that communicates via telegram to evade network restrictions
https://github.com/machine1337/TelegramRAT

Living Off the Foreign Land

Part 1/3: Setup Linux VM for SOCKS routing
https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform

Part 2/3: Configuring the Offensive Windows VM
https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform-part-2

Part 3/3: Using Windows as Offensive Platform
https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform-part-3

Vcenter Comprehensive Penetration and Exploitation Toolkit
https://github.com/W01fh4cker/VcenterKit

Leveraging VSCode Extensions for Initial Access
https://www.mdsec.co.uk/2023/08/leveraging-vscode-extensions-for-initial-access/

Apache Superset Part II: RCE, Credential Harvesting and More
https://www.horizon3.ai/apache-superset-part-ii-rce-credential-harvesting-and-more/

Geolocating a Traveler via OSINT techniques

https://medium.com/@ronkaminskyy/geolocating-a-traveler-via-osint-techniques-ed34ed120a00

#PHP 8.1.0-dev then try #RCE & SQLi
Try : User-Agentt: zerodiumsleep(5);
Try : User-Agentt: zerodiumsystem('id');

Bypassing UAC with SSPI Datagram Contexts

https://splintercod3.blogspot.com/p/bypassing-uac-with-sspi-datagram.html