265 matches found
CVE-2024-49126
Windows Local Security Authority Subsystem Service LSASS Remote Code Execution Vulnerability...
CVE-2024-49126
Windows Local Security Authority Subsystem Service LSASS Remote Code Execution Vulnerability...
June 11, 2024—KB5039260 (Monthly Rollup)
None None...
NativeDump - Dump Lsass Using Only Native APIs By Hand-Crafting Minidump Files (Without MinidumpWriteDump!)
NativeDump allows to dump the lsass process using only NTAPIs generating a Minidump file with only the streams needed to be parsed by tools like Mimikatz or Pypykatz SystemInfo, ModuleList and Memory64List Streams. NTOpenProcessToken and NtAdjustPrivilegeToken to get the "SeDebugPrivilege"...
June 11, 2024—KB5039266 (Security-only update)
None None...
June 11, 2024—KB5039274 (Security-only update)
None None...
June 11, 2024—KB5039289 (Monthly Rollup)
None None...
KB5037426: Update to address a known issue that affects LSASS in Windows Server 2012 R2
KB5037426: Update to address a known issue that affects LSASS in Windows Server 2012 R2 Summary This update addresses a known issue that affects the Local Security Authority Subsystem Service LSASS. It might leak memory on domain controllers DCs. This issue occurs after you install KB5035885 Marc...
March 22, 2024—KB5037422 (OS Build 20348.2342) Out-of-band
None None...
MultiDump - Post-Exploitation Tool For Dumping And Extracting LSASS Memory Discreetly
MultiDump is a post-exploitation tool written in C for dumping and extracting LSASS memory discreetly, without triggering Defender alerts, with a handler written in Python. Blog post: https://xre0us.io/posts/multidump MultiDump supports LSASS dump via ProcDump.exe or comsvc.dll, it offers two...
March 12, 2024—KB5035849 (OS Build 17763.5576) - EXPIRED
None None...
March 12, 2024—KB5035857 (OS Build 20348.2340)
None None...
March 12, 2024—KB5035885 (Monthly Rollup)
None None...
March 12, 2024—KB5035855 (OS Build 14393.6796) - EXPIRED
None None...
February 13, 2024—KB5034769 (OS Build 25398.709)
None None...
February 13, 2024—KB5034766 (OS Build 22000.2777)
None None...
February 13, 2024—KB5034768 (OS Build 17763.5458) - EXPIRED
None None...
PPLBlade - Protected Process Dumper Tool
Protected Process Dumper Tool that support obfuscating memory dump and transferring it on remote workstations without dropping it onto the disk. Key functionalities : 1. Bypassing PPL protection 2. Obfuscating memory dump files to evade Defender signature-based detection mechanisms 3. Uploading...
NoFilter Attack: Sneaky Privilege Escalation Method Bypasses Windows Security
A previously undetected attack method called NoFilter has been found to abuse the Windows Filtering Platform WFP to achieve privilege escalation in the Windows operating system. "If an attacker has the ability to execute code with admin privilege and the target is to perform LSASS Shtinkering,...