Fuck-Etw

「⚙️」Bypass di ETW e Unhooking di Ntdll Bypassa l'Event Trace Windows ETW e rimuovi l'hook di ntdll. root@kitploit: |\ /| | \ /\ \ /|\ /| | /| || /| \ / /| / | | | | | | || | | / / | | | | | | | | | | | || | | | | | | | | | | | | | || | | \ \ | | | | || || | | | || /| / \ | /\ | | | | |/ /|/...

PatchlessCLRLoader

PatchlessCLRLoader PatchlessCLRLoader è un fork di InlineExecute-Assembly per caricare assembly .NET e indirizzare l'output a mailslot. L'ho riscritto come loader standalone con la seguente implementazione: Payload con crittografia AES Supporto payload fileless Bypass patchless di AMSI ed ETW...

LetMeowIn

LetMeowIn Un dump di LSASS sofisticato e furtivo che utilizza C++ e MASM x64. Come visto su Binary Defense e Cyber Security News Esclusione di responsabilità Non essere malvagio con questo. Ho creato questo strumento per imparare. Non sono responsabile se i federali bussano alla tua porta...

AMSI-patches-learned-till-now

AMSI-Patches, die ich bisher gelernt habe Ich habe alle AMSI-Patches dokumentiert, die ich bisher gelernt habe ❗ Mein AMSI-Patch-Wissen bisher. Gehört nicht zum Vermögen meines Unternehmens! HAFTUNGSAUSSCHLUSS: Dieser Code ist bisher nicht zur Umgehung gedacht! Nur ein konzeptioneller Ansatz!...

CVE-2026-11281

Integer overflow in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted ETW event. Chromium security severity: Low...

CVE-2026-11281

Integer overflow in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted ETW event. Chromium security severity: Low...

CVE-2025-23385

In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local Privilege Escalation via the ETW Host Service was possible...

JetBrains Rider 2024.1.x < 2024.1.7 / 2024.2.x < 2024.2.8 / 2024.3.x < 2024.3.4 Local Privilege Escalation (CVE-2025-23385)

The version of JetBrains Rider installed on the remote host 2024.1.x prior to 2024.1.7, 2024.2.x prior to 2024.2.8, or 2024.3.x prior to 2024.3.4. It is, therefore, affected by a local privilege escalation vulnerability: - In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider befo...

CVE-2025-23385

In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local Privilege Escalation via the ETW Host Service was possible...

CVE-2025-23385

In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local Privilege Escalation via the ETW Host Service was possible...

CVE-2025-23385

CVE-2025-23385 affects JetBrains ReSharper (before 2024.3.4, 2024.2.8, 2024.1.7), Rider (before 2024.3.4, 2024.2.8, 2024.1.7), dotTrace (before 2024.3.4, 2024.2.8, 2024.1.7), and ETW Host Service (before 16.43). The issue enables a Local Privilege Escalation via the ETW Host Service due to incorr...

CVE-2025-23385

In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local Privilege Escalation via the ETW Host Service was possible...

CVE-2025-23385

In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local Privilege Escalation via the ETW Host Service was possible...

PT-2025-4868 · Jetbrains · Resharper +2

Name of the Vulnerable Software and Affected Versions: JetBrains ReSharper versions prior to 2024.3.4 JetBrains Rider versions prior to 2024.3.4 dotTrace versions prior to 2024.3.4 ETW Host Service versions prior to 16.43 Description: The issue is related to incorrect process management in the...

JetBrains多款产品 安全漏洞

JetBrains Rider and others are products of the Czech company JetBrains.JetBrains Rider is a set of cross-platform integrated development environments IDEs for .NET.JetBrains ReSharper is a Visual Studio extension for .NET development.JetBrains NET performance analysis tool for detecting and...

A Bag of RATs: VenomRAT vs. AsyncRAT

Introduction Remote access tools RATs have long been a favorite tool for cyber attackers, since they enable remote control over compromised systems and facilitate data theft, espionage, and continuous monitoring of victims. Among the well-known RATs are VenomRAT and AsyncRAT. These are open-sourc...

Velociraptor 0.7.1 Release

Written by Dr. Michael Cohen Sigma Support, ETW Multiplexing, Local Encrypted Storage and New VQL Capabilities Highlight the Last Release of 2023 Rapid7 is excited to announce that version 0.7.1 of Velociraptor is live and available for download. There are several new features and capabilities th...

Velociraptor 0.7.1 Release

Written by Dr. Michael Cohen Sigma Support, ETW Multiplexing, Local Encrypted Storage and New VQL Capabilities Highlight the Last Release of 2023 Rapid7 is excited to announce that version 0.7.1 of Velociraptor is live and available for download. There are several new features and capabilities th...

BestEdrOfTheMarket - Little AV/EDR Bypassing Lab For Training And Learning Purposes

Little AV/EDR Evasion Lab for training & learning purposes. ️ under construction..​ | | | | | | \ / \ / | | | | | \ / / | | | | | | | | | | | | | | | | | | ' \ / \ | | | /\ \ | | || || | | || | | | | | | | | / |/||/| ||/|| \ /|| || || ||| | / | | | | | | |/| |/ | '| |/ / \ | | | | | | | |...

LightsOut - Generate An Obfuscated DLL That Will Disable AMSI And ETW

LightsOut will generate an obfuscated DLL that will disable AMSI & ETW while trying to evade AV. This is done by randomizing all WinAPI functions used, xor encoding strings, and utilizing basic sandbox checks. Mingw-w64 is used to compile the obfuscated C code into a DLL that can be loaded into a...