DuplicateDump

DuplicateDump DuplicateDump is a fork of MirrorDump with following modifications: DInovke implementation LSA plugin DLL written in C++ which could be clean up after dumping LSASS. MirrorDump compile LSA plugin as .NET assembly which would not be unloaded by LSASS process. That's why MirrorDump...

cve-2025-2783-chrome_sandbox_escape_reproduction

CVE-2025-2783: Google Chrome Mojo 샌드박스 탈출 CVSS 점수: 8.3 높음 발견자: Kaspersky 상태: 실제 환경에서 적극적으로 악용됨 스파이 캠페인 개요 CVE-2025-2783는 Google Chrome의 Mojo 프로세스 간 통신IPC 프레임워크에서 발견된 Windows 전용 권한 상승 취약점입니다. 이 취약점은 Mojo 메시지 전달 계층의 잘못된 핸들 처리를 악용하여 손상된 렌더러 프로세스가 Chrome 샌드박스를 탈출할 수 있게 합니다. 이 CVE는 언론인과 반대파 인사를 노리는 활발...

nanodump

NanoDump LSASS 프로세스의 미니덤프를 생성하는 유연한 도구입니다. 목차 1. 사용법 2. 기능 3. 기법 조합 4. 예제 5. HTTPS 리디렉터 1. 사용법 usage: Z:\nanodump.x64.exe --write C:\Windows\Temp\doc.docx --valid --duplicate --elevate-handle --duplicate-elevate --seclogon-leak-local --seclogon-leak-remote C:\Windows\notepad.exe...

LogMeInPoCHandleDup

LogMeIn / GoTo LMIInfo.sys 핸들 복제 요약 LogMeIn / GoTo RMM에서 제공하는 LMIInfo.sys 드라이버에는 SYSTEM 프로세스에서 임의의 핸들을 복제할 수 있는 경쟁 조건race condition이 존재합니다. 핵심 문제는 디바이스 개체에 대한 적절한 액세스 제어가 부족하고, 시스템 프로세스에서 사용자가 지정한 핸들을 복제하도록 한 명백히 잘못된 결정에 있습니다. 세부 정보 IOCTL: 0x9211001C 입력 버퍼: // LMI-Common.cpp typedef struct LMIINF...

ps-ppl-bypass

Process Explorer の脆弱なドライバによる PPL バイパス SysInternals Process Explorer のドライバ（PSEXP152.sys）の古いバージョン（17.x より前）が脆弱であり、PPL プロセスへのフルアクセスプロセスハンドルを開くために悪用可能であることはよく知られていますが（IOCTL: 0x8335003c）、新しいバージョン（17.x 以降）も依然として脆弱であり、別のドライバ関数（IOCTL: 0x83350014）を使って同じことが可能です。 この IOCTL 関数は任意のハンドルを複製し、ドライババージョン 17.00...

MemGuard

🛡️ MemGuard — ゼロ依存のLSASSメモリシールド & EDRフック検出器 -0078D6.svg?logo=windows&logoColor=white -brightgreen.svg 不正なLSASSメモリアクセス、ハンドルの複製、およびLOLBinによる資格情報ダンプの試行をリアルタイムで検出・緩和する、軽量でゼロ依存のWindows EDRユーティリティ。 📌 脅威の概要: なぜLSASSを保護するのか? Windowsエンタープライズ環境では、Local Security Authority Subsystem Service lsass.exe...

Astra Linux – Vulnerability in curl

This flaw allows an attacker to insert cookies into a running program using libcurl, provided that certain conditions are met. Libcurl performs transfers. In its API, an application creates “easy handles”—individual handles used for single transfers. Libcurl provides a function called...

EUVD-2007-6669

Malware in sbrugna...

AZL-31502 CVE-2023-38546 affecting package cmake for versions less than 3.21.4-10

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a functio...

Design/Logic Flaw

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a functio...

CVE-2023-5174

If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. This bug only affects Firefox on Windows when run in non-standard configurations such as using runas...

CVE-2023-5174

If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. This bug only affects Firefox on Windows when run in non-standard configurations such as using runas...

Design/Logic Flaw

If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. This bug only affects Firefox on Windows when run in non-standard configurations such as using runas...

CVE-2023-5174

The CVE-2023-5174 entry describes a Windows-specific issue in the Firefox sandbox handling: if a process fails to duplicate a handle during process creation, the sandbox code may double-free a pointer, causing a use-after-free and potentially an exploitable crash. Affected products are Firefox be...

CVE-2023-5174

If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. This bug only affects Firefox on Windows when run in non-standard configurations such as using runas...

CVE-2023-5174

If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. This bug only affects Firefox on Windows when run in non-standard configurations such as using runas...

SUSE CVE-2023-5174

If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. This bug only affects Firefox on Windows when run in non-standard configurations such as using runas...

Security Vulnerabilities fixed in Firefox 118 — Mozilla

A compromised content process could have provided malicious data to FilterNodeD2D1 resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process.This bug only affects Firefox on Windows. Other operating systems are unaffected. A compromised content proces...

Nanodump - A Crappy LSASS Dumper With No ASCII Art

A flexible tool that creates a minidump of the LSASS process. 1. Features It uses syscalls with SysWhispers2 for most operations. Syscalls are called from an ntdll address to bypass some syscall detections. It sets the syscall callback hook to NULL. Windows APIs are called using dynamic invoke...

Microsoft Windows 10 1809 - LUAFV Delayed Virtualization Cross Process Handle Duplication Exploit

Exploit for windows platform in category local exploits Windows: LUAFV Delayed Virtualization Cross Process Handle Duplication EoP Platform: Windows 10 1809 not tested earlier Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User boundary Summary: The LUAFV...