52 matches found
KSLDBYOVDARK
KSLDBYOVD Reference: KslKatz and KslDump. KslD.sys, a.k.a. MpKslDrv.sys, used to be one of the anti-rootkit tool drivers of Microsoft Antimaware which includes Microsoft Defender Antivirus, Windows Defender Antivirus in the old Windows versions, Microsoft Security Essentials, System Center Endpoi...
CVE-2022-26809
CVE-2022-26809 This repo just simply research for the CVE, for more detailed ananlysis,please refer here. UPDATE:05/19 2022 This ananlyze hasn't been finished yet.... UPDATE:05/22 2022 HuanGMz Post and corelight blog show the real vulnerable point: OSFCASSOCIATION::ProcessBindAckOrNak This...
TrollDump
TrollDump Injects x64 managed DLL into x64 managed/unmanaged process process must have GUI because we obtain its windows handle using setwindowshook Here as a TROLL, we inject into hidden window taskmgr to do a lsass dump undetected see Test Case section below The injector DLL and injected DLL is...
nosferatu
nosferatu Windows NTLM/Kerberos 認証バックドア 動作原理 まず、DLL が lsass.exe プロセスにインジェクションされ、認証 WinAPI 呼び出しをフックし始めます。対象となる関数は次のとおりです： NTLM: NtlmShared!MsvpPasswordValidate Kerberos: cryptdll!CDLocateCSystem Kerberos: samsrv!SamIRetrieveMultiplePrimaryCredentials...
Cve-2022-26809
Cve-2022-26809 CVE-2022-26809 このリポジトリは単にCVEの調査を行うものです。詳細な分析については、こちらを参照してください。 更新:05/19 2022 この分析はまだ完了していません…… 更新:05/22 2022 HuanGMzの投稿 と corelightのブログ が実際の脆弱性箇所を示しています： OSFCASSOCIATION::ProcessBindAckOrNak この脆弱性は CVE-2021-43893 と同様にトリガーされます。ESFRPCリクエストを UNCパス と共に lsass.exe に送信すると、被害者はターゲットに...
CVE-2026-38053---Remove-PPL
CVE-2026-38053---Remove-PPL BYOVD Remove PPL for 24H2 and 25H2 An arbitrary memory write in the handler for IOCTL 0x12C807 METHODNEITHER of Wise System Monitor v1.5.3.127 allows attackers to cause a remove PPL or Denial of Service DoS via a crafted input. Additional Information Tested on: Windows...
MemGuard
🛡️ MemGuard — ゼロ依存のLSASSメモリシールド & EDRフック検出器 -0078D6.svg?logo=windows&logoColor=white -brightgreen.svg 不正なLSASSメモリアクセス、ハンドルの複製、およびLOLBinによる資格情報ダンプの試行をリアルタイムで検出・緩和する、軽量でゼロ依存のWindows EDRユーティリティ。 📌 脅威の概要: なぜLSASSを保護するのか? Windowsエンタープライズ環境では、Local Security Authority Subsystem Service lsass.exe...
Exploit for Stack-based Buffer Overflow in Microsoft
⚡ CVE-2026-41089 | Netlogon RCE Core Diagnostic Module...
CVE-2026-62784
Microsoft Local Security Authority Server (lsasrv) is affected by CVE-2026-62784 due to a heap-based buffer overflow that allows an authorized attacker to execute code over the network. CVSS v3.1 score: 8.8 (High) with Network access, Low complexity, Privileges Required: Low, User Interaction: No...
CVE-2026-15430: Improper Privilege Management
Improper access control in the IRPMJWRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected lsass.exe, and terminate PPL-protected...
CVE-2025-14963
A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulnerable Driver BYOVD was leveraged to gain access to the critical Windows process memory lsass.exe Loc...
CVE-2025-14963: Improper Input Validation
A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulnerable Driver BYOVD was leveraged to gain access to the critical Windows process memory lsass.exe Loc...
EUVD-2001-1103
Malware in sbrugna...
CVE-1999-0227
Access violation in LSASS.EXE LSA/LSARPC program in Windows NT allows a denial of service...
June 11, 2024—KB5039212 (OS Builds 22621.3737 and 22631.3737)
None None...
June 11, 2024—KB5039217 (OS Build 17763.5936) - EXPIRED
None None...
June 11, 2024—KB5039225 (OS Build 10240.20680) - EXPIRED
None None...
June 11, 2024—KB5039227 (OS Build 20348.2527)
None None...