LOLBAS

Living Off The Land Binaries and Scripts and now also Libraries All the different files can be found behind a fancy frontend here: https://lolbas-project.github.io thanks @ConsciousHacker for this bit of eyecandy and the team over at https://gtfobins.github.io/. This repo serves as a place where ...

DSCourier

DSCourier Description DSCourier is a proof-of-concept that uses the WinGet Configuration COM API to apply DSC configurations through Microsoft-signed binaries. A separate blog post provides the full technical deep dive into the technique. DSCourier was built primarily from a research topic and...

CVE-2026-25250

🕷️ CVE-2026-25250：可信引导加载程序链验证不当 一个由 Microsoft 签名的第三方引导加载程序，加载了无签名或完整性验证的二级 EFI 二进制文件，从内部瓦解了 Secure Boot 信任链。 📑 目录 研究背景 官方参考 自行复现 受影响引导链 漏洞概述 📂 Secure Boot 与信任模型 根本原因分析 利用过程 缓解与吊销 🧠 研究背景 本仓库记录了针对 CVE-2026-25250 的研究，这是一个已向 Microsoft 披露并于 2026 年 4 月分配 CVE 编号的 Secure Boot...

CVE-2022-42046

EvilWfshbr CVE-2022-42046 wfshbr64.sys 本地权限提升的概念验证 wfshbr64.sys 和 wfshbr32.sys 的特制载荷允许任意用户以任意的 EPROCESS 偏移量和标志值执行位运算，通过操纵 EPROCESS.Protection 和 EPROCESS.SignatureLevel 标志，故意将游戏进程提升到 CodeGen Full 保护级别（将安全漏洞作为功能）。 该驱动程序由通过 Microsoft 硬件计划提交的 Microsoft 硬件兼容发布者签名。 本项目与 @DoranekoSystems 共同研究。 有一个功能丰富的...

lolbin-poc

lolbin-poc 使用微软签名可执行文件作为 lolbin 的小型 PoC。 构建（32位） root@kitploit: cmake -B build32 -A Win32 cmake --build build32 --config Release 构建（64位） root@kitploit: cmake -B build64 -A x64 cmake --build build64 --config Release 使用方法 从此处下载 WinDbg，并将编译好的 dbgeng.dll 放到 windbg.exe 旁边。 额外内容 还有一些其他 DLL 可供使用：...

PT-2026-33497

Name of the Vulnerable Software and Affected Versions Microsoft-signed third-party bootloader affected versions not specified Description A security-feature bypass allows attackers to affect the system. A Microsoft-signed third-party bootloader completely skips signature verification when loading...

New Fake CAPTCHA Scam Abuses Microsoft Tools to Install Amatera Stealer

Another day, another fake CAPTCHA scam, but this one abuses Microsoft’s signed tools...

K000152613: Secure Boot Bypass vulnerability CVE-2025-3052

Security Advisory Description An arbitrary write vulnerability in Microsoft signed UEFI firmware allows for code execution of untrusted software. This allows an attacker to control its value, leading to arbitrary memory writes, including modification of critical firmware settings stored in NVRAM...

CVE-2025-3052

CVE-2025-3052 is listed as an arbitrary write vulnerability affecting Microsoft-signed UEFI firmware, enabling code execution of untrusted software and potential modification of NVRAM-stored firmware settings. The CVE entry shown links CVE-2025-3052 to DT Research Inc. in the CVE List entry, and ...

shim security update

shim - 15.8-2.0.3.el7 - Set shim.ol sbat generation to 3 Orabug: 36271343 - 15.8-2.0.1.el7 - Set SBATAUTOMATICDATE to 2021030218 Orabug: 36271343 - Rebuild with Oracle certificates Orabug: 36271343 - Full list of fixed CVEs: CVE-2023-40546, CVE-2023-40547, CVE-2023-40548, CVE-2023-40549,...

Chinese Hackers Deploy Microsoft-Signed Rootkit to Target Gaming Sector

Cybersecurity researchers have unearthed a novel rootkit signed by Microsoft that's engineered to communicate with an actor-controlled attack infrastructure. Trend Micro has attributed the activity cluster to the same actor that was previously identified as behind the FiveSys rootkit, which came ...

Ransomware Attackers Use Microsoft-Signed Drivers to Gain Access to Systems

Microsoft on Tuesday disclosed it took steps to implement blocking protections and suspend accounts that were used to publish malicious drivers that were certified by its Windows Hardware Developer Program. The tech giant said its investigation revealed the activity was restricted to a number of...

High-Severity Windows UAC Flaw Enables Privilege Escalation

Researchers disclosed details of a high-severity Microsoft Windows vulnerability that could give attackers elevated privileges – ultimately allowing them to install programs, and view, change or delete data. The bug stems from User Account Control UAC, a security feature of Windows within Secure...

Applocker Evasion - Windows Presentation Foundation Host

This module will assist you in evading Microsoft Windows Applocker and Software Restriction Policies. This technique utilises the Microsoft signed binary PresentationHost.exe to execute user supplied code. This module requires Metasploit: https://metasploit.com/download Current source:...

LOLBAS - Living Off The Land Binaries And Scripts (LOLBins And LOLScripts)

The goal of the LOLBAS project is to document every binary, script, and library that can be used for Living Off The Land techniques. All the different files can be found behind a fancy frontend here: https://lolbas-project.github.io thanks @ConsciousHacker for this bit of eyecandy and the team ov...

Manipulating Microsoft WSUS to Own Enterprises

LAS VEGAS – Windows Server Update Services WSUS is your friend, if you run an enterprise IT shop, because it facilitates the download and distribution of security patches, service pack installations and hardware driver updates among others. Two researchers this week at the Black Hat conference,...

microsoft-install.txt

Juan asked me to forward this message from him to the list. He has discovered that an ActiveX control shipped with IE can be used to install software components signed by Microsoft without prompting the user. This of curse raises trust issues. Someone, not necessarily Microsoft, could use this...