RawHive

RawHive RawHive è un BOF di Cobalt Strike per estrarre selezionati alvei del registro di Windows direttamente da un volume NTFS grezzo. Salta le normali API dei file, esamina i metadati NTFS per trovare i record di file di destinazione e copia i byte direttamente dal disco. Attualmente cerca:...

BlockGuard

🛡️ BlockGuard — प्रक्रिया-आधारित फ़ाइल एक्सेस सुरक्षा एजेंट BlockGuard एक विंडोज डेटा हानि रोकथाम DLP एजेंट है जो प्रक्रिया स्तर पर फ़ाइल एक्सेस को इंटरसेप्ट और नियंत्रित करता है। यह सुनिश्चित करता है कि केवल अधिकृत प्रक्रियाएँ — निष्पादन योग्य पथ, क्रिप्टोग्राफिक हैश, ऑथेंटिकोड हस्ताक्षर और अखंडत...

irflow-timeline

IRFlow Timeline Analisi nativa di timeline forensi su macOS. Importa, cerca e indaga artefatti EVTX, CSV, XLSX, Plaso, $MFT, $J e assistenti AI locali — con AI Secret Hunt e le analisi di cui i professionisti DFIR hanno realmente bisogno. Costruito su Electron + SQLite per gestire milioni di righ...

ntfstool

ntfstool NTFSTool è uno strumento forense focalizzato sui volumi NTFS. Supporta la lettura delle informazioni sulle partizioni MBR, tabella delle partizioni, VBR ma anche informazioni su Master File Table, volumi crittografati con Bitlocker, file crittografati con EFS, journal USN e altro. Scaric...

RecuperaBit

RecuperaBit Eine Software, die versucht, Dateisystemstrukturen zu rekonstruieren und Dateien wiederherzustellen. Derzeit wird nur NTFS unterstützt. RecuperaBit versucht die Verzeichnisstruktur unabhängig von folgenden Gegebenheiten zu rekonstruieren: fehlende Partitionstabelle unbekannte...

CVE-2026-33825

🔵 CVE-2026-33825 — “BlueHammer” 🔵 Escalatazione dei Privilegi Locale LPE di Microsoft Defender BlueHammer è una vulnerabilità di escalation dei privilegi locale ad alta gravità che colpisce i componenti di Microsoft Defender sui sistemi Windows. Il difetto consente a un utente malintenzionato con...

CVE-2021-43229

CVE-2021-43229: Procedura dettagliata Informazioni pubbliche Vulnerabilità di elevazione dei privilegi di Windows NTFS Distinto da: CVE-2021-43230 CVE-2021-43231 Patch: 14 dicembre 2021 Secondo @AravGarg3 su Twitter, CVE-2021-43229 sembra essere sfruttabile e correlato a un integer overflow. Font...

Ubuntu 20.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8668-1)

"The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8668-1 advisory. Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations,...

CVE-2024-27518

CVE-2024-27518 - PoC LPE per SUPERAntiSpyware Professional X Questa vulnerabilità è stata scoperta e divulgata da M. Akil Gündoğan del Secunnix Vulnerability Research Team. Questo repository conterrà la proof-of-concept e gli advisory. Dettagli: Prodotto: SUPERAntiSpyware Professional X e tutte l...

RAR-Anomaly-Inspector

RAR Anomaly Inspector RAR Anomaly Inspector è uno strumento PowerShell di sola lettura per ispezione statica degli archivi RAR , progettato per rilevare anomalie di path traversal relative a CVE-2025-8088 WinRAR RAR5 Path Traversal. Lo strumento non estrae né esegue il contenuto degli archivi...

CVE-2024-44193

Windows über iTunes hacken – Lokale Privilegienausweitung 0-Day Einführung zu CVE-2024–44193 Dies ist ein Write-up über CVE-2024–44193, einen Local Privilege Escalation Exploit in iTunes Version 12.13.2.3. Es wurde am 12. September 2024 von Apple gepatcht. Link zum Apple Security Advisory: Apple...

UnderlayCopy

UnderlayCopy UnderlayCopy é um utilitário PowerShell para aquisição NTFS de baixo nível e extração de artefatos de sistema protegidos e bloqueados por exemplo: SAM , SYSTEM , NTDS.dit , hives do registro e outros arquivos normalmente inacessíveis enquanto o Windows está em execução. Ele suporta...

CVE-2026-56136

A flaw was found in NTFS-3G. An out-of-bounds read vulnerability exists that allows a remote attacker to read potentially confidential information within an ntfs-3g process. This can be triggered by crafting a malicious NTFS image and creating a file with a specially crafted name. Mitigation To...

ntfsDump

ntfsDump Utilizzato per copiare un file da un volume partizionato NTFS leggendo il volume grezzo e analizzando le strutture NTFS. Simile a https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Invoke-NinjaCopy.ps1...

tscopy

TScopy Updated 2022-03-31 Introducing TScopy It is a requirement during an Incident Response IR engagement to have the ability to analyze files on the filesystem. Sometimes these files are locked by the operating system OS because they are in use, which is particularly frustrating with event logs...

blindsight

blindsight "Não existe isso de sobrevivência do mais forte. Sobrevivência do mais adequado, talvez. Não importa se uma solução é ótima. Tudo o que importa é se ela é melhor que a alternativa." -- Peter Watts, Blindsight 2006 Ferramenta de red team para despejar a memória do LSASS, ignorando...

CVE-2026-56135

In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function buildinheritedid in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted...

CVE-2026-56136

In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfsirnill in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name...

CVE-2026-56135

A flaw was found in NTFS-3G. This vulnerability involves a heap-based buffer overflow, which occurs when the software attempts to write more data to a memory block than it can hold. An attacker can exploit this by creating a specially crafted NTFS image and then creating a file within a malicious...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: fs/ntfs3: Validates the BOOT recordsize field. When the NTFS BOOT recordsize field is less than 0, it represents a shift value. However, there is no sanity check on the shift result, and the sbi-recordbits calculation using...