166 matches found
dumpguard_bof
DumpGuard BOF DumpGuard 的 Beacon Object File BOF 移植，用于从现代 Windows 系统的会话中提取 NTLMv1 哈希。 关于本项目 本仓库包含 DumpGuard 的 Beacon Object File BOF 实现，从原始的 C/.NET 实现移植到纯 C 语言，以便在 Havoc 和其他支持 BOF 执行的 C2 框架中使用。 这是一个概念验证 PoC 和学习练习。 这个 BOF 移植是我个人学习远程凭据保护协议、Kerberos 身份验证流程以及底层 Windows 安全机制细节的一部分。将该工具从 C 移植到纯 C 以用于 B...
DumpGuard
DumpGuard DumpGuardは、最新のWindowsシステム向けの資格情報ダンプおよびプロトコル調査ツールです。Remote Credential Guardプロトコルを悪用して、Credential Guardが有効な場合でも資格情報を復元し、さらにセッション指向のNTLM抽出のためのMicrosoft v1認証パッケージパスも含んでいます。 現在の機能は以下の通りです: NTLMv1応答 NTLMv2応答 Kerberosサービスチケット ローカルログオンセッションのMicrosoft v1認証パッケージダンプ...
NativeBypassCredGuard
NativeBypassCredGuard NativeBypassCredGuard 是一款通过仅使用 NTAPI 函数（由 ntdll.dll 导出）修补 WDigest.dll 来绕过 Credential Guard 的工具。它提供两种版本：C 和 C++。 该工具在磁盘上的 WDigest.dll 文件中定位模式 "39 ?? ?? ?? ?? 00 8b ?? ?? ?? ?? 00"（如参考资料部分的第一篇文章所述，该模式在所有 Windows 版本的这个文件中都存在），然后计算所需的内存地址，最后修补 WDigest.dll 中两个变量的值：...
lazarus-sigma-rules
Lazarus Sigma 规则 本仓库中的 Sigma 规则由 F-Secure Countercept 检测与响应团队创建，旨在为 Lazarus 组织近期使用的工具、技术与程序提供检测覆盖。 关于这些 Sigma 规则创建过程的博客文章可在此处查看： https://labs.f-secure.com/blog/catching-lazarus-threat-intelligence-to-real-detection-logic...
BypassCredGuard
BypassCredGuard - Bypass de Credential Guard mediante el parcheo de la memoria de Wdigest Antecedentes Adam Chester @xpn escribió un artículo titulado "Exploring Mimikatz - Part 1 - WDigest" sobre el parcheo de memoria para habilitar UseLogonCredential y hacer que Wdigest almacene en caché...
CVE-2026-72958
Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally...
CVE-2026-70578
Heap-based buffer overflow in Windows Credential Guard allows an authorized attacker to elevate privileges locally...
CVE-2026-70578
CVE-2026-70578 is a heap-based buffer overflow in Windows Credential Guard that allows an authorized local attacker to elevate privileges . The Microsoft-assigned CVSS 3.1 score is 7.0 (High) , with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H , indicating local access, high attack complexity,...
EUVD-2026-73655
Heap-based buffer overflow in Windows Credential Guard allows an authorized attacker to elevate privileges locally...
EUVD-2026-73115
Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally...
CVE-2026-72958
CVE-2026-72958 is a double free vulnerability in Windows Credential Guard that allows an authorized attacker to elevate privileges locally . The flaw resides in the Credential Guard component of Windows, a security feature that isolates user credentials from the rest of the operating system. The ...
Windows Credential Guard Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Credential Guard allows an authorized attacker to elevate privileges locally...
Windows Credential Guard Elevation of Privilege Vulnerability
Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally...
CVE-2026-64111
A flaw was found in the Linux kernel's Security Module LSM. A local attacker could exploit this vulnerability by leveraging an improper handling of a credential guard mutex in the lsmsetselfattr function. This oversight may allow the attacker to bypass security restrictions enforced by modules su...
CVE-2026-64111 lsm: hold cred_guard_mutex for lsm_set_self_attr()
In the Linux kernel, the following vulnerability has been resolved: lsm: hold credguardmutex for lsmsetselfattr Just as procpidattrwrite already does before calling the LSM hook. This only matters for SELinux and AppArmor which check whether the process is being ptraced and if so, whether to allo...
CVE-2026-64111
The CVE-2026-64111 issue affects the Linux kernel where lsm_set_self_attr() did not hold cred_guard_mutex in the same way as proc_pid_attr_write() before calling the LSM hook. The fix ensures the mutex is held, reducing risk related to SELinux and AppArmor decisions based on whether a process is ...
EUVD-2026-3111
Microsoft Edge Elevation Service exposes a privileged COM interface that inadequately validates the privileges of the calling process. A standard non‑administrator local user can invoke the IElevatorEdge interface method LaunchUpdateCmdElevatedAndWait, causing the service to execute privileged...
CVE-2026-21223
Improper privilege management in Microsoft Edge Chromium-based allows an authorized attacker to bypass a security feature locally...