EDRSandblast - Tool That Weaponize A Vulnerable Signed Driver To Bypass EDR Detections And LSASS Protections

EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections Kernel callbacks and ETW TI provider and LSASS protections. Multiple userland unhooking techniques are also implemented to evade userland monitoring. As of release, combination of userland...

CVE-2019-16098

The driver in Micro-Star MSI Afterburner 4.6.2.15658 aka RTCore64.sys and RTCore32.sys allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These...

CVE-2019-16098: Out-of-bounds Read

The driver in Micro-Star MSI Afterburner 4.6.2.15658 aka RTCore64.sys and RTCore32.sys allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These...