msidump

msidump MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner. On Macro-enabled Office documents we can quickly use oletools mraptor to determine whether document is malicious. If we want to dissect it further, we...

shakeitoff

shakeitoff A smaller, minimized, and cleaner version of InstallerFileTakeOver aka the zero-day exploit that is a "variation" of CVE-2021-41379 later assigned CVE-2021-43883. This version does not pop a shell like InstallerFileTakeOver. The point of this code was to create a simpler proof of conce...

CVE-2022-22077

✅ CVE-2022-22077 exploitation framework RTCore64.sys: This document provides a comprehensive overview of the CVE-2022-22077 exploitation framework, a sophisticated BYOVD Bring Your Own Vulnerable Driver attack toolkit that targets the RTCore64.sys driver vulnerability. This framework demonstrates...

CVE-2024-50804

CVE-2024-50804 Writeup can be found on my blog below. Thanks! https://g3tsyst3m.github.io/cve/msi/Arbitrary-Write-Privilege-Escalation-CVE-2024-50804/...

CVE-2021-27965

CVE-2021-27965 The MsIo64.sys driver before 1.1.19.1016 in MSI Dragon Center before 2.0.98.0 has a buffer overflow that allows privilege escalation via a crafted 0x80102040, 0x80102044, 0x80102050, or 0x80102054 IOCTL request. This exploit will be finished, this is a guarantee...

CVE-2024-37726-MSI-Center-Local-Privilege-Escalation

CVE-2024-37726 MSI Center Local Privilege Escalation - Arbitrary File Overwrite Vulnerability Vulnerability Summary A local privilege escalation vulnerability on Windows OS has been identified in MSI Center versions = 2.0.36.0, which allows a low-privileged user to arbitrarily overwrite or delete...

msi-central_privesc

CVE-2022-38532 Local privilege escalation in MSI Center desktop application. The vulnerability exist in "CFeatures" of MSI.CentralServer.exe. MSI.CentralServer.exe is an application that gathers information about your system, it collaborates with MSI.TerminalServer.exe. The ExecuteTask function...

CVE-2025-26125

Description The PoC program exploits the IMFForceDelete driver which exposes an ioctl that allows unprivileged users to delete files and folders. We can turn this into a privilege escalation by using a technique explained by ZDI and Halov, which exploits the MSI rollback mechanism which is design...

msidump

msidump MSI Dump - un outil qui analyse les packages d'installation MSI malveillants, extrait les fichiers, les flux, les données binaires et intègre un scanner YARA. Sur les documents Office avec macros activées, nous pouvons rapidement utiliser oletools mraptor pour déterminer si le document es...

MSI_FeatureManager_CVE

KernCoreLib64.sys Vulnerability PoC Physical Memory and I/O Port Abuse for Privilege Escalation...

CVE-2026-90007

A flaw was found in the Linux kernel's pm8001 SCSI driver. When pm8001requestmsix attempts to free Message Signaled Interrupts MSI-X vectors, it uses an incorrect index during the rollback process. This error prevents previously registered interrupt handlers from being properly deallocated, leadi...

CVE-2021-29337

CVE-2021-29337 - Privilege Escalation in MODAPI.sys MSI Dragon Center General Affected Product: MSI Dragon Center Affected Version: 2.0.104.0 CVE MITRE Description A vulnerable kernel driver MODAPI.sys in dragon center exposes IOCTL 0x9C406104 which allows low-privileged users to interact directl...

CVE-2024-37726-MSI-Center-Local-Privilege-Escalation

CVE-2024-37726 MSI Center Élévation de privilèges locale - Vulnérabilité d'écrasement arbitraire de fichiers...

qlikview-poc-CVE-2024-29863

Affected application: QlikView Platform: Windows Issue: Local Privilege Escalation via MSI installer DLL hijacking race condition Discovered and reported by: Pawel Karwowski and Julian Horoszkiewicz Eviden Red Team Details: On systems with QuikView12 installed, it is possible for regular users to...

rewolf-msi-exploit

rewolf-msi-exploit MSI NTIOLib/WinIO 로컬 권한 상승 더 많은 정보는 여기에서 확인할 수 있습니다: http://blog.rewolf.pl/blog/?p=1630...

Vision-MSI-Thermal-Control

Vision MSI Thermal Control MSI Modern 15H AI C1MG-096IT Linux thermal management - Reverse engineered EC control with fan profiles and battery threshold 🎯 Purpose of this Project This application was born out of necessity for MSI laptop users on Linux. The journey began when I discovered that...

NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE

NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE Этот эксплойт восстанавливает и использует CVE-2019-16098, который находится в драйвере Micro-Star MSI Afterburner 4.6.2.15658 также известном как RTCore64.sys и RTCore32.sys, позволяет любому аутентифицированному пользователю читать и записывать в произвольную...

POC-CVE-2024-12227

CVE-2024-12227 - NTIOLibX64.sys DoS PoC Доказательство концепции PoC для CVE-2024-12227 - уязвимость разыменования нулевого указателя Null Pointer Dereference в драйвере NTIOLibX64.sys от MSI Dragon Center. Description NTIOLibX64.sys версии 3.0.0.10 содержит уязвимость разыменования нулевого...

CVE-2020-17382

CVE-2020-17382 Windows 10 x64 2004 Build 19041.264 Эксплойт Особая благодарность @matteomalvica за то, что он задал мне так много вопросов об этой уязвимости, что это вынудило меня написать для него эксплойт для последней версии Windows 10 19041.264 без KVA Shadow т.е. для процессоров, не уязвимы...

LolModapi

привет, хакеры. Это неаутентифицированная запись в MSR внутри MODAPI.sys — драйвера ядра, который устанавливает MSI Dragon Center 2.0.155.0. Драйвер предоставляет объект устройства с дескриптором безопасности, который позволяет любому локальному пользователю открыть его — без прав администратора ...