CVE-2024-21338-Exploit

CVE-2024-21338 Exploit Project Introduction This is a POC for CVE-2024-21338, a privilege escalation vulnerability in the Windows AppLocker driver appid.sys. It was exploited as a 0-day by the Lazarus group for local privilege escalation on Windows. Vulnerability Background CVE-2024-21338 is a...

SharpAppLocker

SharpAppLocker C port of the Get-AppLockerPolicy PowerShell cmdlet with extended features. Includes the ability to filter and search for a specific type of rules and actions. Useful when you already bypassed AppLocker initially and you don't want to leave PS logs Looking for a pre-compiled versio...

EDR-GhostLocker

GhostLocker: AppLocker-Based EDR Neutralization Introduction After my article on Fairy-Law , where I used kernel mitigations to disable Endpoint Detection & Response EDR solutions, diversenok pointed out that IFEO exclusions Image File Execution Options were too invasive for third-party...

Empire

Empire Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers. The Empire server is written in Python 3 and is modular to allow operator flexibility. Empire comes built-in with a client that can be used remotely to access the server...

Get-AppLockerEventlog

Get-AppLockerEventlog DESCRIPTION This script will parse all the channels of events from the win-event log to extract all the log relatives to AppLocker. The script will gather all the important pieces of information relative to the events for forensic or threat-hunting purposes, or even in order...

BOF-pack-1

BOF-pack-1 A care package of useful bofs for red team engagments GetAppLockerPolicy Prints the Effective AppLockerPolicy for the domain TokenElevate Creates a process with winlogon's tokenIncludes Tcb Privilege enabled by default and other winlogon specific privileges. Alternative way to elevate ...

pentesting-lab-ntlm-relay

NTLM Relay & SMB Exploitation Lab 🎯 !Pentestinghttps://img...

Windows PowerShell CLM Bypass (TEMP redirect)

Bypass PowerShell Constrained Language Mode by launching a child powershell.exe with TEMP/TMP redirected to an AppLocker-allowed path default C:\Windows\Temp. PowerShell probes AppLocker script rules via a temp script; an allowed TEMP yields FullLanguage. !/usr/bin/env python3 -- coding: utf-8 --...

Windows MSBuild / InstallUtil Reverse TCP

AppLocker-style bypass: MSBuild inline C task or InstallUtil-compatible DLL running a C reverse shell. Pair with listeners/multi/reversetcp. from kittysploit import import base64 class ModulePayload: CLIENTLANGUAGE = "msbuild" info = "name": "Windows MSBuild / InstallUtil Reverse TCP",...

Windows Gather AppLocker & WDAC Audit

Audit AppLocker and WDAC enforcement !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows Gather AppLocker & WDAC Audit", "description": "Audit AppLocke...

Windows Gather Computer Detail

Runs Get-ComputerDetail on a Windows shell or Meterpreter session to collect logon, PowerShell, AppLocker, and RDP client artifacts. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import WindowsSessionMixin import re class ModulePost,...

Applocker Filter Driver Privilege Escalation

The vulnerability of the Applocker Filter Driver applockerfltr.sys in the Windows operating system is related to synchronization errors when using common resources. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2026-25184

Concurrent execution using shared resource with improper synchronization 'race condition' in Applocker Filter Driver applockerfltr.sys allows an authorized attacker to elevate privileges locally...

EUVD-2026-22367

Concurrent execution using shared resource with improper synchronization 'race condition' in Applocker Filter Driver applockerfltr.sys allows an authorized attacker to elevate privileges locally...

CVE-2026-25184

Concurrent execution using shared resource with improper synchronization 'race condition' in Applocker Filter Driver applockerfltr.sys allows an authorized attacker to elevate privileges locally...

CVE-2026-25184

Technical details about CVE-2026-25184 are not publicly provided in the supplied documents. No information on affected products, targeted components, impact, or fixes is available here. Monitor for updates.

CVE-2026-25184 Applocker Filter Driver (applockerfltr.sys) Elevation of Privilege Vulnerability

...

CVE-2026-25184 Applocker Filter Driver (applockerfltr.sys) Elevation of Privilege Vulnerability

...

Applocker Filter Driver (applockerfltr.sys) Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Applocker Filter Driver applockerfltr.sys allows an authorized attacker to elevate privileges locally...

CVE-2026-25184: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Applocker Filter Driver applockerfltr.sys allows an authorized attacker to elevate privileges locally...