27 matches found
CVE-2021-21551
CVE-2021-21551 一个利用Dell的dbutil23驱动程序的PoC。在HVCI禁用的系统上将获得代码执行，如下所示： 输出： 此代码的详细说明可在此处找到：https://ch3rn0byl.com/2021/05/a-dell-cve-2021-21551/...
CVE-2024-21305
CVE-2024-21305 此仓库包含 CVE-2024-21305 的报告和 PoC，即 Hypervisor-Protected Code Integrity HVCI 的非安全配置漏洞。该漏洞允许在根分区内执行任意内核模式代码，从而有效绕过 HVCI。有关根本原因，请阅读与 Andrea Allievi @aall86 共同撰写的博客文章，他是分析并修复该问题的 Windows Core OS 工程师。 此仓库中的报告是我发送给 MSRC 的内容，其中包含 PoC 和对该问题的初步分析。 时间线 7月2日，Satoshi 就漏洞的有效性咨询了 Andrea。...
CVE-2024-21338
CVE-2024-21338 Local Privilege Escalation from Admin to Kernel vulnerability on Windows 10 and Windows 11 operating systems with HVCI enabled. Compiling Use Microsoft Visual Studio with the C++ package to successfully compile the PoC on both Release and Debug modes. Post Original blog post:...
BlackLotus
BlackLotus BlackLotus es un innovador bootkit UEFI diseñado específicamente para Windows. Incorpora una omisión integrada de Secure Boot y protección Ring0/Kernel para prevenir cualquier intento de eliminación. Este software tiene el propósito de funcionar como un cargador HTTP. Gracias a su...
CVE-2024-21338-x64-build-
CVE-2024-21338 在启用了HVCI的Windows 10和Windows 11操作系统上，从管理员权限提升至内核权限的本地权限提升漏洞。...
HVCIPwned
CVE-2024-35250 通过 Windows 内核流驱动程序（ks.sys）中的不可信指针解引用实现本地权限提升。纯数据利用 — 绕过虚拟机监控程序保护的代码完整性（HVCI）。 摘要 字段| 详情 ---|--- CVE| CVE-2024-35250 组件| ks.sys（内核流） 漏洞类型| 不可信指针解引用 影响| 权限提升至 NT AUTHORITY\SYSTEM HVCI| 已绕过 — 内核中无代码执行 补丁| KB5039212（2024年6月） 受影响系统| Windows 10 20H1+ / Windows 11 21H2-23H2 漏洞...
CVE-2025-7771-Vulnerability-Exploration
🔓 ThrottleStop.sys 内核漏洞 — 兼容 HVCI 的物理内存映射器 CVE-2025-7771 — 通过 ThrottleStop.sys IOCTL 实现任意物理内存读写 ⚠️ 免责声明 本项目仅用于教育和研究目的 。目的在于演示一个经过签名、受信任的内核驱动程序如何被武器化，用于从管理员权限提升至 SYSTEM/内核 权限，有效绕过包括 HVCI（超管理器强制代码完整性） 和 安全启动 在内的现代 Windows 安全功能。 请勿将此工具用于恶意目的。 作者对任何滥用行为不承担责任。 📋 目录 漏洞概要 受影响软件 技术分析 存在漏洞的 IOCTL 根本原因 利用链...
EUVD-2024-19140
Malicious code in bioql PyPI...
Exploit for Untrusted Pointer Dereference in Microsoft
CVE-2024-21338 Local Privilege Escalation from Admin to Kernel...
Exploit for Untrusted Pointer Dereference in Microsoft
CVE-2024-21338 Local Privilege Escalation from Admin to Kernel...
CVE-2024-21431 Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability
...
CVE-2024-21431
CVE-2024-21431 is a Microsoft Windows vulnerability titled “Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability.” Connected sources identify this as a local, high-severity issue affecting the HVCI mechanism, with a CVSS score in the high range (confidentiality, integr...
Security feature bypass
Hypervisor-Protected Code Integrity HVCI Security Feature Bypass Vulnerability...
CVE-2024-21305
CVE-2024-21305 is a Hypervisor-Protected Code Integrity (HVCI) security feature bypass affecting Windows; the CVE entry notes a local attack surface with high privileges required and no user interaction (per CVSS details). Connected Microsoft documentation confirms the vulnerability and lists it ...
Exploit for Incorrect Permission Assignment for Critical Resource in Microsoft
CVE-2024-21305 This repo contains the report and PoC of CVE-...
Guidance for investigating attacks using CVE-2022-21894: The BlackLotus campaign
This guide provides steps that organizations can take to assess whether users have been targeted or compromised by threat actors exploiting CVE-2022-21894 via a Unified Extensible Firmware Interface UEFI bootkit called BlackLotus. UEFI bootkits are particularly dangerous as they run at computer...
Guidance for investigating attacks using CVE-2022-21894: The BlackLotus campaign
This guide provides steps that organizations can take to assess whether users have been targeted or compromised by threat actors exploiting CVE-2022-21894 via a Unified Extensible Firmware Interface UEFI bootkit called BlackLotus. UEFI bootkits are particularly dangerous as they run at computer...
Guidance on Microsoft Signed Drivers Being Used Maliciously
Executive Summary: Microsoft was recently informed that drivers certified by Microsoft’s Windows Hardware Developer Program were being used maliciously in post-exploitation activity. Microsoft has completed its investigation and determined that the activity was limited to the abuse of several...
New Windows 11 security features are designed for hybrid work
Attackers are constantly evolving, becoming increasingly sophisticated and destructive—the median time for an attacker to access your private data if you fall victim to a phishing email is 1 hour, 12 minutes.1 Microsoft tracks more than 35 ransomware families and more than 250 unique nation-state...