Microsoft Windows - nt!NtQuerySystemInformation (information class 138, QueryMemoryTopologyInformati

Exploit for windows platform in category dos / poc / We have discovered that the nt!NtQuerySystemInformation system call invoked with the 138 information class discloses portions of uninitialized kernel pool memory to user-mode clients. The specific information class is handled by an internal...

Makin - Reveal Anti-Debugging Tricks

makin is to make initial malware assessment little bit easier, It helps to reveal a debugger detection techniques used by a sample. Supports x64 and x86 How does it work? makin opens a sample as a debuggee and injects asho.dll, asho.dll hooks several functions at ntdll.dll library and after...

Microsoft Windows 10 (Build 1703 Creators Update) (x86) - 'WARBIRD' 'NtQuerySystemInformation ' Kernel Local Privilege Escalation

/ EDB Note Source https://gist.github.com/xpn/736daa4d1ff7b9869f4b3d1e9a34d315/ff2e2465d4a07588d0148dc87e77b17b41ef9d1d Source https://blog.xpnsec.com/windows-warbird-privesc/ Source https://github.com/xpn/warbirdexploit Ref https://bugs.chromium.org/p/project-zero/issues/detail?id=1391 / //...

Microsoft Windows 10 Creators Update 32-bit Ring-0 Code Execution Exploit

Microsoft Windows 10 Creators Update suffers from a 32-bit execution of ring-0 code from NULL page via NtQuerySystemInformation class 185, Warbird functionality. Windows 10 Creators Update 32-bit execution of ring-0 code from NULL page via NtQuerySystemInformation class 185, Warbird functionality...

Kernel pool overflow exploit combat of Windows 10-bug warning-the black bar safety net

One, Foreword This is the kernel pool overflow exploit combat of Windows 7 throughout the sequel, we will be in the Windows 10 system to achieve the same exploits, it will be more challenging because of Microsoft ever since Windows 8 has taken a lot for the kernel pool attacks defenses. This...

Microsoft Windows Kernel - 'win32k.sys NtSetWindowLongPtr' Local Privilege Escalation (MS16-135) (2)

/ Source: https://ricklarabee.blogspot.com/2017/01/virtual-memory-page-tables-and-one-bit.html Binary: https://github.com/rlarabee/exploits/raw/8b9eb646516d7f022a010f28018209f331c28975/cve-2016-7255/compiled/cve-2016-7255.exe Mirror:...

Microsoft Windows 10 - pcap Driver Privilege Escalation

Microsoft Windows 10 - pcap Driver Privilege Escalation // Source: https://github.com/Rootkitsmm/Win10Pcap-Exploit include include include include include include include include include define SLIOCTLGETEVENTNAME CTLCODE0x8000, 1, METHODNEITHER, FILEANYACCESS define STATUSSUCCESS...

Windows 10 pcap Drive Local Privilege Escalation

Source: https://github.com/Rootkitsmm/Win10Pcap-Exploit include include include include include include include include include define SLIOCTLGETEVENTNAME CTLCODE0x8000, 1, METHODNEITHER, FILEANYACCESS define STATUSSUCCESS NTSTATUS0x00000000L define STATUSINFOLENGTHMISMATCH NTSTATUS0xc0000004L /...

Windows NDProxy Privilege Escalation XP SP3 x86 and 2003 SP2 x86 (MS14-002) Exploit

NDPROXY is a system-provided driver that interfaces WAN miniport drivers, call managers, and miniport call managers to the Telephony Application Programming Interfaces TAPI services. The vulnerability is caused when the NDProxy.sys kernel component fails to properly validate input. An attacker wh...

Microsoft Windows XP SP3 (x86) / 2003 SP2 (x86) - 'NDProxy' Local Privilege Escalation (MS14-002)

/ Exploit Title: Windows NDProxy Privilege Escalation MS14-002 Date: 2015-08-03 Exploit Author: Tomislav Paskalev Vulnerable Software: Windows XP SP3 x86 Windows XP SP2 x86-64 Windows 2003 SP2 x86 Windows 2003 SP2 x86-64 Windows 2003 SP2 IA-64 Supported vulnerable software: Windows XP SP3 x86...

BullGuard (Multiple Products) - Arbitrary Write Privilege Escalation

BullGuard Multiple Products - Arbitrary Write Privilege Escalation / Exploit Title - BullGuard Multiple Products Arbitrary Write Privilege Escalation Date - 04th February 2015 Discovered by - Parvez Anwar @parvezghh Vendor Homepage - http://www.bullguard.com/ Tested Version - 14.1.285.4 Driver...

BullGuard (Multiple Products) - Arbitrary Write Privilege Escalation

/ Exploit Title - BullGuard Multiple Products Arbitrary Write Privilege Escalation Date - 04th February 2015 Discovered by - Parvez Anwar @parvezghh Vendor Homepage - http://www.bullguard.com/ Tested Version - 14.1.285.4 Driver Version - 1.0.0.6 - BdAgent.sys Tested on OS - 32bit Windows XP SP3...

Symantec Altiris Agent 6.9 (Build 648) - Local Privilege Escalation

Symantec Altiris Agent 6.9 Build 648 - Local Privilege Escalation / Exploit Title - Symantec Altiris Agent Arbitrary Write Privilege Escalation Date - 01st February 2015 Discovered by - Parvez Anwar @parvezghh Vendor Homepage - http://www.symantec.com Tested Version - 6.9 Build 648 Driver Version...

DESlock+ <= 4.1.10 vdlptokn.sys Local Kernel ring0 SYSTEM Exploit

Exploit for windows platform in category local exploits / deslock-vdlptokn.c Copyright c 2009 by DESlock+ include include include define VDLPTOKNIOCTL 0x00222010 define DLKFDISKRIOCTL 0x80002008 define DLKFDISKSLOT 0x00000CF8 define ARGSIZEa a/sizeof void / Win2k3 SP1/2 - kernel EPROCESS token...

DriveCrypt 5.3 - Local Kernel Ring0 SYSTEM

DriveCrypt 5.3 - Local Kernel Ring0 SYSTEM / drivecrypt-dcr.c Copyright c 2009 by DriveCrypt include include include define DCRIOCTL 0x00073800 static unsigned char win32fixup = "\x89\xe5" "\x81\xc5\xb4\x0c\x00\x00"; / Win2k3 SP1/2 - kernel EPROCESS token switcher by mu-b / static unsigned char...

DriveCrypt 5.3 - Local Kernel Ring0 SYSTEM

/ drivecrypt-dcr.c Copyright c 2009 by DriveCrypt include include include define DCRIOCTL 0x00073800 static unsigned char win32fixup = "\x89\xe5" "\x81\xc5\xb4\x0c\x00\x00"; / Win2k3 SP1/2 - kernel EPROCESS token switcher by mu-b / static unsigned char win2k3ring0shell = / ring0 /...

Microsoft Windows NT200020032008XPVista7 - KiTrap0D User Mode to Ring Escalation (MS10-015)

Microsoft Windows NT200020032008XPVista7 - KiTrap0D User Mode to Ring Escalation MS10-015 Exploit-DB Mirror: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/11199.zip KiTrap0D.zip E-DB Note: Make sure to run "vdmallowed.exe" pre-compiled inside the subfolder...

Windows NT User Mode to Ring 0 Escalation Vulnerability

Exploit for unknown platform in category local exploits ======================================================= Windows NT User Mode to Ring 0 Escalation Vulnerability ======================================================= Microsoft Windows NT GP Trap Handler Allows Users to Switch Kernel Stack...

SafeNet 10.4.0.12 - IPSecDrv.sys Local kernel Ring0 SYSTEM

SafeNet 10.4.0.12 - IPSecDrv.sys Local kernel Ring0 SYSTEM / safenet-ipsec-call.c Copyright c 2008 by Safenet IPSecDrv.sys include include include define IPSECDRVIOCTL 0x80002064 define ARGSIZEa a/sizeof void static unsigned char win32fixup = "\x53" "\x52"; static unsigned char win2k3ring0shell =...

Microsoft Windows - GDI Privilege Escalation (MS07-017) (1)

Microsoft Windows - GDI Privilege Escalation MS07-017 1 define WIN32WINNT 0x0500 include include include pragma comment lib, "user32.lib" pragma comment lib, "gdi32.lib" pragma comment lib, "shlwapi.lib" pragma comment lib, "ntdll.lib" / Here is a sploit for the GDI MS07-017 Local Privilege...