EDR-Freeze

EDR-Freeze 这是一个利用 WerFaultSecure 的软件漏洞来挂起 EDR 和反恶意软件进程的工具，无需使用 BYOVD（自带易受攻击驱动程序）攻击方法。 EDR-Freeze 在用户模式下运行，因此您无需安装任何额外的驱动程序。它可以在最新版本的 Windows 上运行。 实验是在项目创建时最新版本的 Windows 上进行的：Windows 11 24H2 命令行语法 EDR-Freeze.exe TargetPID SleepTime 示例：EDR-Freeze.exe 1234 10000 将目标冻结 10000 毫秒 链接 EDR-Freeze：让 EDR...

kurasagi

kurasagi kurasagi 是适用于 Windows 24H2 - 25H2 的 PatchGuard 绕过完整 POC。 更多信息请参阅 product 分支，其中包含详细介绍该绕过方法的 PDF 论文。 如果出现任何与CRITICALSTRUCTURECORRUPTION（PatchGuard）相关的 BSOD，请创建 issue 并附上相关信息！ 免责声明 1. 请仅将其用于教育目的！ 2. 运行时请勿开启基于虚拟机监控程序的安全功能！（否则会导致 BSOD！） 3. 使用 kdmapper 加载驱动。 4. 在加载 kurasagi 之后，我们发现当你使用...

Windows-11-24h2-Kernel-Exploit

Windows-11-24h2-Kernel-Exploit Windows 11 24h2 LPE内核利用。CVE-2020-12446eneio64.sys...

CVE-2025-60709

🚨 漏洞利用PoC — 仅供安全研究、漏洞分析与防御用途 🚨 PoC DE EXPLOIT — SOLO PARA INVESTIGACIÓN DE SEGURIDAD, ANÁLISIS DE VULNERABILIDADES Y FINES DEFENSIVOS 🌐 语言 / Idiomas 🇪🇸 西班牙语 🇬🇧 英语 🇪🇸 西班牙语文档 描述 CVE-2025-60709 是 Windows CLFS.sys （通用日志文件系统）驱动中的一个本地权限提升（LPE） 漏洞。它允许具有本地代码执行能力的攻击者通过 CLFS 容器解析中的缓冲区溢出，从标准用户提升到 NT...

CVE-2026-21250

CVE-2026-21250: Windows HTTP.sys 本地权限提升 Windows 11 24H2 - 本地权限提升 🚨 CVE-2026-21250 漏洞的技术分析与资源 Windows 11 24H2 / 25H2 - Windows Server 2022/2025 本仓库包含 CVE-2026-21250 漏洞的技术文档与资源，该漏洞是 Windows HTTP.sys 驱动程序中不可信指针解引用（Untrusted Pointer Dereference）缺陷，可导致本地权限提升（LPE）。 📝 描述 该漏洞允许具有低权限且可本地访问系统的攻击者，利用 HTTP.s...

windows_kernel_shadow_stack

概念验证 本项目旨在突出微软在 Windows 11 中实现的影子栈（shadow stack）缓解措施的某些方面。 该代码专门针对 Windows 11 24H2。 由于内核偏移量管理的原因，它可能无法在其他版本的 Windows 11 上运行 。 项目分为两部分：一个客户端和一个驱动程序。 它们之间的通信通过 IOCTL 机制处理。 客户端请求驱动程序在内核级别执行操作。 功能 递增当前线程的一个内核返回地址，使其未对齐并触发蓝屏（BSOD）。 跳过当前线程的一个内核栈帧，以凸显影子栈的韧性。 启用/禁用当前 CR4 寄存器中的 CET，会导致蓝屏（BSOD）。 写入 MSR...

July 14, 2026-KB5101001 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 11, version 24H2

None None...

July 14, 2026-KB5100998 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 11, version 25H2 and Microsoft server operating system 24H2

None None...

Microsoft Windows TCP/IP 缓冲区错误漏洞

Microsoft Windows TCP/IP is a component provided by Microsoft Corporation that offers TCP/IP configuration functions for Windows. There are security vulnerabilities present in Microsoft Windows TCP/IP. The following products and versions are affected: Windows Server 2022, Windows Server 2022 Serv...

Microsoft Windows Push Notifications 信息泄露漏洞

Microsoft Windows Push Notifications is a push notification service provided by Microsoft Corporation. It provides a reliable way to deliver new updates. However, Microsoft Windows Push Notifications has information leakage vulnerabilities. Attackers can exploit these vulnerabilities to obtain...

Microsoft Windows SDK 数字错误漏洞

Microsoft Windows is an operating system used by personal devices by the American company Microsoft. There is a vulnerability in input validation of Microsoft Windows. Attackers can exploit this vulnerability to gain higher privileges. The following products and versions are affected: Windows 11...

Microsoft Windows DHCP Server 输入验证错误漏洞

Microsoft Windows DHCP Server is a core service of the American company Microsoft, used for automatically retrieving network configuration information. There are security vulnerabilities in Microsoft Windows DHCP Server. The following products and versions are affected: Windows 10 Version 22H2 fo...

Microsoft Windows Kernel 缓冲区错误漏洞

The Microsoft Windows Kernel is the kernel of the Windows operating system developed by Microsoft Corporation. There are security vulnerabilities in the Microsoft Windows Kernel. Attackers can exploit these vulnerabilities to gain higher privileges. The following products and versions are affecte...

Microsoft Windows Push Notifications 竞争条件问题漏洞

Microsoft Windows Push Notifications is a push notification service provided by the American company Microsoft. It provides a reliable way to deliver new updates. There are compatibility issues with Microsoft Windows Push Notifications. The following products and versions are affected: Windows...

Microsoft Remote Desktop Client 缓冲区错误漏洞

Microsoft Remote Desktop Client is a remote desktop client developed by Microsoft Corporation. There are security vulnerabilities in Microsoft Remote Desktop Client. Attackers can exploit these vulnerabilities to execute code remotely. The following products and versions are affected: Windows...

Microsoft Windows Secure Boot 软件供应链问题漏洞

Microsoft Windows Secure Boot is a security boot mechanism developed by Microsoft Corporation. There are security vulnerabilities associated with Microsoft Windows Secure Boot. Attackers can exploit these vulnerabilities to bypass certain features. The following products and versions are affected...

Microsoft Hyper-V 缓冲区错误漏洞

Microsoft Hyper-V is an application developed by Microsoft Corporation in the United States. It is a system management program that enables desktop virtualization. There is a code execution vulnerability present in Microsoft Hyper-V. Attackers can exploit this vulnerability to execute arbitrary...

Microsoft Windows Kernel 缓冲区错误漏洞

The Microsoft Windows Kernel is the kernel of the Windows operating system developed by Microsoft Corporation. There are security vulnerabilities in the Microsoft Windows Kernel. Attackers can exploit these vulnerabilities to execute code. The following products and versions are affected: Windows...

Microsoft Windows Kerberos 异常处理不当漏洞

Microsoft Windows Kerberos is a software developed by Microsoft for authentication in network clusters. As a network authentication protocol, its primary goal is to provide robust authentication services for client/server applications through a key system. There are code-related vulnerabilities i...

Microsoft Windows Kernel Mode Drivers 缓冲区错误漏洞

Microsoft Windows is an operating system used on personal devices by the American company Microsoft. There are security vulnerabilities in Microsoft Windows. Attackers can exploit these vulnerabilities to gain higher privileges. The following products and versions are affected: Windows Server 202...