AMSI-patches-learned-till-now

AMSI-patches-learned-till-now I have documented all of the AMSI patches that I learned till now ❗ My AMSI patch Learning till now. Doesn't belong to my Company's Asset! DISCLAIMER: This code is not meant to be Evasive till now! Only a Conceptual Approach. Links: 1...

CVE-2023-3640

SCTF2023kernelpwn SCTF 2023 kernel pwn Off-topic: A little advertisement — the author is a 2024 undergraduate graduate student, participating in this year's autumn recruitment. Feel free to contact me sycrop This problem aims to test two points. 1. The starting points of the cpu entry area mappin...

RustChain

설명 이 도구는 하드웨어 브레이크포인트와 결합된 ROP 체인을 사용하여 메모리 아티팩트를 숨기는 방법에 대한 간단한 PoC입니다. ROP 체인은 Sleep 함수가 호출되는 동안즉, Sleep이 호출될 때 기본 모듈 메모리 페이지의 보호를 N/A로 변경합니다. 이 메모리 스캐닝 회피 기술에 대한 자세한 내용은 원본 프로젝트 Gargoyle을 확인하세요. x64 전용. 아이디어는 kernel32!Sleep에 하드웨어 브레이크포인트를 설정하고 예외를 처리할 새로운 최상위 필터를 설정하는 것입니다. Sleep이 호출되면 이전에 설정된...

TamperingSyscalls

TamperingSyscalls TamperingSyscalls is a 2 part novel project consisting of argument spoofing and syscall retrival which both abuse EH in order to subvert EDRs. This project consists of both of these projects in order to provide an alternative solution to direct syscalls. Tampering with syscalls...

PatchlessCLRLoader

PatchlessCLRLoader PatchlessCLRLoader is a fork of InlineExecute-Assembly to load .NET assembly and direct the output to mailslot. I rewrites it to a standalone loader with the following implementation: AES encryption payload Fileless payload support Patchless AMSI and ETW bypass using hardware...

Voidgate

VOIDGATE Description: A technique that can be used to bypass AV/EDR memory scanners. This can be used to hide well-known and detected shellcodes such as msfvenom by performing on-the-fly decryption of individual encrypted assembly instructions, thus rendering memory scanners useless for that...

mora-hwbp

Mora-HWBP — AMSI / WLDP / ETW Telemetry Hooking via Hardware Breakpoints A security-research Proof-of-Concept POC demonstrating hardware-breakpoint CPU debug register based function hooking as an alternative to traditional in-memory code patching. Purpose & Scope This repository is published...

CVE-2021-47006 ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook

In the Linux kernel, the following vulnerability has been resolved: ARM: 9064/1: hwbreakpoint: Do not directly check the event's overflowhandler hook The commit 1879445dfa7b "perf/core: Set event's default ::overflowhandler" set a default event-overflowhandler in perfeventalloc, and replace the...

UVI-2021-1000450 ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook

ARM: 9064/1: hwbreakpoint: Do not directly check the event's overflowhandler hook This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.191 by...

The vulnerability of the `modify_user_hw_breakpoint()` function in the Linux operating system allows a hacker to execute arbitrary code.

The vulnerability of the modifyuserhwbreakpoint function in the Linux operating system is related to incorrect error handling. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2018-1000199

An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint CONFIGHAVEHWBREAKPOINT support. While modifying a h/w breakpoint via 'modifyuserhwbreakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to...

Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2018-1266)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization 2.5.1 : kernel (EulerOS-SA-2018-1263)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual SDM was mishandle...

EulerOS Virtualization 2.5.0 : kernel (EulerOS-SA-2018-1266)

According to the version of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint CONFIGHAVEHWBREAKPOINT support. While...

Amazon Linux AMI : kernel (ALAS-2018-1023)

A weakness was found in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated. CVE-2018-1108 A flaw was found in the way the Linux kernel handled exceptions delivered after a stac...

Amazon Linux 2 : kernel (ALAS-2018-1023)

A weakness was found in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated. CVE-2018-1108 A flaw was found in the way the Linux kernel handled exceptions delivered after a stac...

Important: kernel

Issue Overview: A weakness was found in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated. CVE-2018-1108 A flaw was found in the way the Linux kernel handled exceptions...

kernel: ptrace() incorrect error handling leads to corruption and DoS

An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint CONFIGHAVEHWBREAKPOINT support. While modifying a h/w breakpoint via 'modifyuserhwbreakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to...

kernel: ptrace() incorrect error handling leads to corruption and DoS

An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint CONFIGHAVEHWBREAKPOINT support. While modifying a h/w breakpoint via 'modifyuserhwbreakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to...

Microsoft Office 2007 - mso.dll Arbitrary Free (MS15-081)

Microsoft Office 2007 - mso.dll Arbitrary Free MS15-081 Source: https://code.google.com/p/google-security-research/issues/detail?id=417&can=1 The following crash was observed in Microsoft Office 2007 with Microsoft Office File Validation Add-In disabled and Application Verifier enabled for testin...