kurasagi

kurasagi kurasagi は、Windows 24H2 - 25H2 向け PatchGuard バイパスの完全な POC です。 詳細については、バイパスを詳述した PDF 論文が含まれている product ブランチを参照してください。 CRITICALSTRUCTURECORRUPTION（PatchGuard）に関連する BSOD が発生した場合は、その BSOD について issue を作成してください！ 免責事項 1. 教育目的でのみ使用してください！ 2. 実行時にはハイパーバイザーベースのセキュリティ機能を有効にしないでください！（BSOD になります！） 3...

efiguard-detected

efiguard-detect EfiGuard가 patchguard를 죽였는지 확인하는 가장 멍청한 방법입니다. 작동 방식 efiguard는 런타임에 SetVariable 백도어를 남깁니다. 사용자 모드에서 ntoskrnl 베이스의 2바이트를 읽도록 요청하여 확인합니다. MZ가 반환되면 백도어가 활성화된 것이며, efiguard가 제 역할을 한 것이고 pg는 죽은 것입니다. 제한사항 사용자가 기본 DSE 우회 방법DSEDISABLESETVARIABLEHOOK을 선택한 경우에만 작동합니다. 이는 기본값입니다. 대신...

GDRVLoader

GDRVLoader - 在 Windows 10-11 上加载未签名驱动 最初基于 https://github.com/fengjixuchui/gdrv-loader，但进行了改进并支持最新的 Windows 版本。 新增功能 在 Windows 10-11 上加载未签名驱动，且不会被 PatchGuard 检测到。 通过添加脆弱驱动的字节加载功能，提升了可移植性。 CRT 兼容性，代码更简洁，使用更便捷。 简单易用的命令行界面。 使用方法 1. 下载最新版本。 2. a 将目标驱动拖放到 GDRVLoader.exe 上。 b 使用管理员权限在 cmd 中运行工具，命令为...

EfiGuard

개요 EfiGuard는 부팅 시 Windows 부팅 관리자, 부트 로더, 커널을 패치하여 PatchGuard 및 DSEDriver Signature Enforcement를 비활성화하는 휴대용 x64 UEFI 부트킷입니다. EfiGuard를 시험해보고 싶다면 사용법으로 건너뛰세요. 기능 현재 Vista SP1부터 Windows 11까지 출시된 모든 EFI 호환 Windows x64 버전을 지원합니다. 사용하기 쉬움: 자동으로 Windows를 찾아 부팅하는 로더를 통해 USB 스틱 또는 Windows EFI 파티션에서 부팅할 수...

Bootlicker - A Generic UEFI Bootkit Used To Achieve Initial Usermode Execution

bootlicker is a legacy, extensible UEFI firmware rootkit targeting vmware hypervisor virtual machines. It is designed to achieve initial code execution within the context of the windows kernel, regardless of security settings configured. Architecture bootlicker takes its design from the legacy...

EfiGuard - Disable PatchGuard And DSE At Boot Time

EfiGuard is a portable x64 UEFI bootkit that patches the Windows boot manager, boot loader and kernel at boot time in order to disable PatchGuard and Driver Signature Enforcement DSE. Features Currently supports all EFI-compatible versions of Windows x64 ever released, from Vista SP1 to Server...

For a driver to mention the right vulnerability analysis-vulnerability warning-the black bar safety net

One, Foreword As Microsoft is constantly reinforcing core safety, enhance the native kernel components of the exploit difficulty, and now third party kernel drivers are gradually becoming the attacker's preferred target, is security analysts the focus of the study. Signed third-party driver...

On GhostHook, Fireball, WannaCry, and more

Mike Mimoso and Chris Brook discuss the news of the week, including Citizen Lab’s latest report, WannaCry hitting Honda, GhostHook, and Fireball. Download: ThreatpostNewsWrapJune232017.mp3 Music by Chris Gonsalves Show notes: GhostHook attack bypasses Windows 10 PatchGuard Say Goodbye to SMBv1 in...

New GhostHook Attack Bypasses Windows 10 PatchGuard Protections

Vulnerabilities discovered in Microsoft PatchGuard kernel protection could allow hackers to plant rootkits on computers running the company's latest and secure operating system, Windows 10. Researchers at CyberArk Labs have developed a new attack technique which could allow hackers to completely...

GhostHook Attack Bypasses Windows 10 PatchGuard

A bypass of PatchGuard kernel protection in Windows 10 has been developed that brings rootkits for the latest version of the OS within reach of attackers. Since the introduction of PatchGuard and DeviceGuard, very few 64-bit Windows rootkits have been observed; Windows 10’s security, in particula...

NSA's DoublePulsar Kernel Exploit In Use Internet-Wide

If you’re on a red team or have been on the receiving end of a pen-test report from one, then you’ve almost certainly encountered reports of Windows servers vulnerable to Conficker MS08-067, which has been in the wild now for nearly 10 years since the bug was patched. A little more than two weeks...

Secret Net 7 and Secret Net Studio 8 - Local Privilege Escalation

Secret Net 7 and Secret Net Studio 8 - Local Privilege Escalation Source: https://github.com/Cr4sh/secretnetexpl Secret Net 7 and Secret Net Studio 8 local privileges escalation exploit. 0day vulnerabilities in sncc0.sys kernel driver of Secrity Code products allows attacker to perform local...

Secret Net 7 and Secret Net Studio 8 - Privilege Escalation

Exploit for windows platform in category local exploits Source: https://github.com/Cr4sh/secretnetexpl Secret Net 7 and Secret Net Studio 8 local privileges escalation exploit. 0day vulnerabilities in sncc0.sys kernel driver of Secrity Code products allows attacker to perform local privileges...

Secret Net 7 and Secret Net Studio 8 - Local Privilege Escalation

Source: https://github.com/Cr4sh/secretnetexpl Secret Net 7 and Secret Net Studio 8 local privileges escalation exploit. 0day vulnerabilities in sncc0.sys kernel driver of Secrity Code products allows attacker to perform local privileges escalation from Guest to Local System. Also, attacker that...

Windows Vista/Server 2008 NtUserCheckAccessForIntegrityLevel Use-after-free Vulnerability

No description provided by source. Due to hostility toward security researchers, the most recent example being of Tavis Ormandy, a number of us from the industry and some not from the industry have come together to form MSRC: the Microsoft-Spurned Researcher Collective. MSRC will fully disclose...

Microsoft Windows Vista2008 - NtUserCheckAccessForIntegrityLevel Use-After-Free

Microsoft Windows Vista2008 - NtUserCheckAccessForIntegrityLevel Use-After-Free Windows Vista/Server 2008 NtUserCheckAccessForIntegrityLevel Use-after-free Vulnerability Intro: Due to hostility toward security researchers, the most recent example being of Tavis Ormandy, a number of us from the...

Microsoft Windows Vista/2008 - NtUserCheckAccessForIntegrityLevel Use-After-Free

Windows Vista/Server 2008 NtUserCheckAccessForIntegrityLevel Use-after-free Vulnerability Intro: Due to hostility toward security researchers, the most recent example being of Tavis Ormandy, a number of us from the industry and some not from the industry have come together to form MSRC: the...