cve-2021-21551-PoC

cve-2021-21551-PoC 이 리포지토리는 dbutil23.sys 드라이버를 취약점에 대해 블라인드 분석할 때 수행한 PoC를 포함합니다. 이는 라이트업을 참고하거나 이 드라이버에 어떤 CVE가 있는지 알지 못한 채 개인 분석을 통해 생성되었습니다. 내가 가진 모든 지식은 이 드라이버가 어떤 방식으로든 취약하다는 것뿐이었습니다...

Dell-Driver-EoP-CVE-2021-21551

Dell 드라이버 권한 상승 CVE-2021-21551 재미로 Dell 드라이버 버그CVE-2021-21551에 대한 간단한 익스플로잇을 만들었습니다. @kasifdekel님의 훌륭한 발견! 분석 글은 여기에서 찾을 수 있습니다. 이 익스플로잇은 Windows 버전 1809 및 20H2에서 테스트되었으며, 다른 버전에서는 토큰 오프셋이 다를 수 있습니다...

CVE-2021-21551-POC

DbUtilAx CVE-2021-21551 Dell 'dbutil23.sys' 커널 익스플로잇에 대한 확장된 개념 증명PoC입니다. 전체 블로그 게시물은 여기에서 읽을 수 있습니다...

CVE-2021-21551

CVE-2021-21551 익스플로잇을 사용한 LPE: System cmd 생성 테스트 환경: Windows 11 21H2 22000.1335...

kernel-mii

Cobalt Strike Beacon Object File 기반으로 CVE-2021-21551을 이용한 커널 익스플로잇을 위한 기초. Tijme 제작. Alex의 가르침에 감사드립니다! Northwave Security의 지원으로 가능했습니다 설명 이것은 CVE-2021-21551을 익스플로잇하는 Cobalt Strike CS Beacon Object File BOF입니다. 단지 비콘 프로세스 토큰을 시스템 프로세스 토큰으로 덮어씁니다. 하지만 이 BOF는 주로 CS를 통한 추가 커널 익스플로잇을 위한 좋은 기초 역할을 합니다...

Exploit for Exposed IOCTL with Insufficient Access Control in Dell Dbutil

CVE-2021-21551 Proof of concept exploit for CVE-2021-21551, vu...

Exploits and TrickBot disrupt manufacturing operations

September 2021 saw a huge spike of exploit detections against the manufacturing industry, with a distributed spread between California, Florida, Ohio, and Missouri. This is combined with heavy detections of unseen malware, identified through our AI engine, spiking in May as well as September 2021...

Driver-Based Attacks: Past and Present

"People that write Ring 0 code and write it badly are a danger to society." - Mickey Shkatov There is no security boundary between an administrator and the Windows kernel, according to the Microsoft Security Servicing Criteria for Windows. In our analysis of CVE-2021-21551, a write-what-where...

Exploit for Exposed IOCTL with Insufficient Access Control in Dell Dbutil

DbUtilAx An extended proof-of-co...

Exploit for Exposed IOCTL with Insufficient Access Control in Dell Dbutil

CVE-2021-21551 Simple PoC for exploiting CVE-2021-21551 for LP...

Exploit for Exposed IOCTL with Insufficient Access Control in Dell Dbutil

Description Script to patch your domain computers about the CV...

Metasploit Wrap-Up

Dell DBUtil23.sys IOCTL memmove privilege escalation Our very own zeroSteiner added a new module, which exploits insufficient access control in Dell's dbutil23.sys firmware update driver included in the Dell Bios Utility that comes pre-installed with most Windows machines. The driver accepts...

Exploit for Exposed IOCTL with Insufficient Access Control in Dell Dbutil

CVE-2021-21551 A PoC that exploits Dell's dbutil23 driver...

DELL dbutil_2_3.sys 2.3 - Arbitrary Write to Local Privilege Escalation (LPE)

Exploit Title: DELL dbutil23.sys 2.3 - Arbitrary Write to Local Privilege Escalation LPE Date: 10/05/2021 Exploit Author: Paolo Stagno aka VoidSec Version: include include include include define IOCTLCODE 0x9B0C1EC8 // IOCTLCODE value, used to reach the vulnerable function taken from IDA define...

DELL dbutil_2_3.sys 2.3 Arbitrary Write / Privilege Escalation

Exploit Title: DELL dbutil23.sys 2.3 - Arbitrary Write to Local Privilege Escalation LPE Date: 10/05/2021 Exploit Author: Paolo Stagno aka VoidSec Version: include include include include define IOCTLCODE 0x9B0C1EC8 // IOCTLCODE value, used to reach the vulnerable function taken from IDA define...

Dell DBUtil_2_3.sys IOCTL Memory Read / Write

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Dell DBUtil23.sys IOCTL memmove', 'Description' = %q The DBUtil23.sys driver distributed by Dell exposes an unprotected IOCTL interface that can ...

Exploit for Exposed IOCTL with Insufficient Access Control in Dell Dbutil

CVE-2021-21551 Exploit to SYSTEM for CVE-2021-21551 SpoolPrin...

BIOS PrivEsc Bugs Affect Hundreds of Millions of Dell PCs Worldwide

PC maker Dell has issued an update to fix multiple critical privilege escalation vulnerabilities that went undetected since 2009, potentially allowing attackers to gain kernel-mode privileges and cause a denial-of-service condition. The issues, reported to Dell by researchers from SentinelOne on...

CVE-2021-21551

creationtimestamp| type| source ---|---|--- 2021-05-04 17:42:38+00:00| seen| https://t.me/ctinow/32853 2021-05-04 17:46:59+00:00| published-proof-of-concept| Telegram/6Sh9mXzmjwiCqYDRD-Q41Yldre37LHa2LS4oXpBfWb-WGg 2021-05-05 04:17:06+00:00| published-proof-of-concept| https://t.me/alexmakus/4056...

Hundreds of Millions of Dell Users at Risk from Kernel-Privilege Bugs

Five high-severity security flaws in Dell’s firmware update driver are impacting potentially hundreds of millions of Dell desktops, laptops, notebooks and tablets, researchers said. The bugs have gone undisclosed for 12 years, and could allow the ability to bypass security products, execute code...