efiguard-detected

efiguard-detect dumbest possible way to check if EfiGuard killed your patchguard or not. how it works efiguard leaves a SetVariable backdoor at runtime - we just poke it from usermode asking to read 2 bytes at ntoskrnl base. if we get back MZ - the backdoor is alive, efiguard did its thing, pg is...

hidden

Hidden 🇺🇦 Hidden has been developed like a solution for reverse engineering and researching tasks. This is a windows driver with a usermode interface which is used for hiding specific environment on your windows machine, like installed RCE programs ex. procmon, wireshark, vm infrastructure ex...

qiling

Qiling's use case, blog and related work Qiling is an advanced binary emulation framework, with the following features: Emulate multi-platforms: Windows, macOS, Linux, Android, BSD, UEFI, DOS, MBR. Emulate multi-architectures: 8086, X86, X8664, ARM, ARM64, MIPS, RISC-V, PowerPC. Support multiple...

acheron

About Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentatio...

CVE-2024-1086

CVE-2024-1086 仅供学习目的。 参考： https://pwning.tech/nftables/ https://github.com/Notselwyn/CVE-2024-1086 Kconfig： root@kitploit: +CONFIGCONFIGFSFS=y +CONFIGSECURITYFS=y +CONFIGNFTABLES=y mnlcbrun: Operation not supported +CONFIGNETFILTERNETLINKGLUECT=y +CONFIGNETLINKDIAG=y +CONFIGNFTCT=y...

osed-scripts

osed-scripts 为 Offensive Security 的 Windows 用户模式漏洞利用开发课程（OSED）量身定制的工具集 目录 独立脚本 egghunter.py find-gadgets.py shellcoder.py install-mona.sh attach-process.ps1 WinDbg 脚本 find-ppr.py find-bad-chars.py search.py 独立脚本 安装： pip3 install keystone-engine numpy egghunter.py 需要 keystone-engine root@kitploit:...

CVE-2026-80564

In the Linux kernel, the following vulnerability has been resolved: gve: fix NULL dereference due to missing ptp adjfine Fix NULL dereference due to missing implementation of adjfine, which can be triggered from usermode as follows: sudo ./testptp -d /dev/ptp0 -f 0 551.943697 BUG: kernel NULL...

UBUNTU-CVE-2026-80564

In the Linux kernel, the following vulnerability has been resolved: gve: fix NULL dereference due to missing ptp adjfine Fix NULL dereference due to missing implementation of adjfine, which can be triggered from usermode as follows: sudo ./testptp -d /dev/ptp0 -f 0 551.943697 BUG: kernel NULL...

CVE-2026-80564

This Linux kernel vulnerability affects the gve (Google Virtual Ethernet) driver. The root cause is a missing implementation of the adjfine PTP operation , which leads to a NULL pointer dereference in ptp_clock_adjtime. The bug can be triggered from usermode via sudo ./testptp -d /dev/ptp0 -f 0, ...

CVE-2026-80564 gve: fix NULL dereference due to missing ptp adjfine

In the Linux kernel, the following vulnerability has been resolved: gve: fix NULL dereference due to missing ptp adjfine Fix NULL dereference due to missing implementation of adjfine, which can be triggered from usermode as follows: sudo ./testptp -d /dev/ptp0 -f 0 551.943697 BUG: kernel NULL...

Linux Distros Unpatched Vulnerability : CVE-2026-80564

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gve: fix NULL dereference due to missing ptp adjfine Fix NULL dereference due to missing implementation of adjfine, which can be triggered from usermode as...

PT-2026-82180

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the gve driver due to a missing implementation of the adjfine function. This issue can be triggered from usermode through the ptp clock adjtime...

Linux-Usermode-Exploitation-101

Linux Usermode Exploitation 101 Introduction The aim of th...

EUVD-2025-35892

An issue was discovered in the NDIS Usermode IO driver RtkIOAC60.sys, version 6.0.5600.16348 allowing local authenticated attackers to send a crafted IOCTL request to the driver to cause a denial of service...

CVE-2025-60419

An issue was discovered in the NDIS Usermode IO driver RtkIOAC60.sys, version 6.0.5600.16348 allowing local authenticated attackers to send a crafted IOCTL request to the driver to cause a denial of service...

EUVD-2018-18014

Malware in sbrugna...

EUVD-2017-18647

Malware in sbrugna...

EUVD-2000-0629

Malware in sbrugna...

EUVD-2000-0052

Malware in sbrugna...

usermode bug fix and enhancement update

An update is available for usermode. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 9.5...