PPLcontrol

PPLcontrol Description This tool allows you to list protected processes, get the protection level of a specific process, or set an arbitrary protection level. For more information, you can read this blog post: Debugging Protected Processes. Usage 1. Download the MSI driver You can get a copy of...

CVE-2022-22077

✅ CVE-2022-22077 exploitation framework RTCore64.sys: This document provides a comprehensive overview of the CVE-2022-22077 exploitation framework, a sophisticated BYOVD Bring Your Own Vulnerable Driver attack toolkit that targets the RTCore64.sys driver vulnerability. This framework demonstrates...

PE-Obfuscator

PE-Obfuscator PE obfuscator with Evasion in mind , needs Admin Privilege in order to load RTCore64 driver. Video: https://user-images.githubusercontent.com/123980007/234171901-c1eb735e-ceca-481d-9310-02ba30f6836b.mp4 The Obfuscator : - Gets xored Fileless PE from a remote server - Drop the Loader...

NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE

NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE This exploit rebuilds and exploit the CVE-2019-16098 which is in driver Micro-Star MSI Afterburner 4.6.2.15658 aka RTCore64.sys and RTCore32.sys allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. Instead of hardcoded base...

CVE-2019-16098

CVE-2019-16098 This CVE exploits the RTCore64.sys driver and creates a cmd.exe process with system privileges by copying the token of the System process with one of the low-privilege cmd.exe process. Blog about the approach and the methodology can be found here...

RTCore64-probe

This repository does not have a README...

EUVD-2024-32318

Malicious code in bioql PyPI...

EUVD-2024-17210

Malicious code in bioql PyPI...

EUVD-2024-17195

Malicious code in bioql PyPI...

CVE-2024-3745

MSI Afterburner v4.6.6.16381 Beta 3 is vulnerable to an ACL Bypass vulnerability in the RTCore64.sys driver, which leads to triggering vulnerabilities like CVE-2024-1443 and CVE-2024-1460 from a low privileged user...

CVE-2024-3745 MSI Afterburner v4.6.6.16381 Beta 3 - ACL Bypass

MSI Afterburner v4.6.6.16381 Beta 3 is vulnerable to an ACL Bypass vulnerability in the RTCore64.sys driver, which leads to triggering vulnerabilities like CVE-2024-1443 and CVE-2024-1460 from a low privileged user...

CVE-2024-3745

MSI Afterburner v4.6.6.16381 Beta 3 is affected by an ACL Bypass in the RTCore64.sys driver, enabling escalation from a low-privilege user and potentially triggering CVE-2024-1443 and CVE-2024-1460. The CVE entry is supported by multiple sources (NVD, CVE lists) with CVSSv3.1 metrics showing LOCA...

CVE-2024-3745 MSI Afterburner v4.6.6.16381 Beta 3 - ACL Bypass

MSI Afterburner v4.6.6.16381 Beta 3 is vulnerable to an ACL Bypass vulnerability in the RTCore64.sys driver, which leads to triggering vulnerabilities like CVE-2024-1443 and CVE-2024-1460 from a low privileged user...

PT-2024-27563 · Msi · Msi Afterburner

Name of the Vulnerable Software and Affected Versions: MSI Afterburner version 4.6.6.16381 Beta 3 Description: The issue is related to an ACL Bypass vulnerability in the RTCore64.sys driver, which can lead to incorrect authorization and potentially compromise the local system. Recommendations:...

CVE-2024-3745: Incorrect Authorization

MSI Afterburner v4.6.6.16381 Beta 3 is vulnerable to an ACL Bypass vulnerability in the RTCore64.sys driver, which leads to triggering vulnerabilities like CVE-2024-1443 and CVE-2024-1460 from a low privileged user...

CVE-2024-1443

MSI Afterburner v4.6.5.16370 is vulnerable to a Denial of Service vulnerability by triggering the 0x80002000 IOCTL code of the RTCore64.sys driver. The handle to the driver can only be obtained from a high integrity process...

CVE-2024-1460

MSI Afterburner v4.6.5.16370 is vulnerable to a Kernel Memory Leak vulnerability by triggering the 0x80002040 IOCTL code of the RTCore64.sys driver. The handle to the driver can only be obtained from a high integrity process...

CVE-2024-1443

MSI Afterburner v4.6.5.16370 is vulnerable to a Denial of Service vulnerability by triggering the 0x80002000 IOCTL code of the RTCore64.sys driver. The handle to the driver can only be obtained from a high integrity process...

CVE-2024-1460

MSI Afterburner v4.6.5.16370 is vulnerable to a Kernel Memory Leak vulnerability by triggering the 0x80002040 IOCTL code of the RTCore64.sys driver. The handle to the driver can only be obtained from a high integrity process...

Code injection

MSI Afterburner v4.6.5.16370 is vulnerable to a Denial of Service vulnerability by triggering the 0x80002000 IOCTL code of the RTCore64.sys driver. The handle to the driver can only be obtained from a high integrity process...