CVE-2022-22077

✅ CVE-2022-22077 利用框架 RTCore64.sys： 本文档全面概述了 CVE-2022-22077 利用框架，这是一个针对 RTCore64.sys 驱动程序漏洞的高级 BYOVD（自带易受攻击驱动程序）攻击工具包。该框架展示了用于教育和安全研究目的的高级 Windows 内核利用技术。 涵盖内容包括漏洞的技术基础、框架架构以及与更广泛的 LazyOwn RedTeam 工具集的集成。有关详细的漏洞分析，请参阅漏洞分析。有关各个组件的具体实现细节，请参阅利用框架。 🚨 CVE-2022-22077 — MSI Center / Dragon Center — 通过...

PPLcontrol

PPLcontrol 説明 このツールを使用すると、保護されたプロセスを一覧表示したり、特定のプロセスの保護レベルを取得したり、任意の保護レベルを設定したりできます。詳細については、次のブログ記事をご覧ください: Debugging Protected Processes。 使用方法 1. MSIドライバーのダウンロード MSIドライバー RTCore64.sys のコピーはこちらから入手できます: PPLKiller/driver。 2. MSIドライバーのインストール 免責事項: 言うまでもなく、このドライバーをホストマシンにインストールしないでください。VMを使用してください！...

CVE-2019-16098

CVE-2019-16098 Esta CVE explota el driver RTCore64.sys y crea un proceso cmd.exe con privilegios del sistema copiando el token del proceso System a uno de los procesos cmd.exe de bajo privilegio. El blog sobre el enfoque y la metodología se puede encontrar aquí...

NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE

NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE 此利用程序重建并利用了CVE-2019-16098漏洞。该漏洞位于Micro-Star MSI Afterburner...

PE-Obfuscator

PE-Obfuscator 以规避（Evasion）为设计目标的 PE 混淆器，需要 管理员权限 才能加载 RTCore64 驱动程序。 视频： https://user-images.githubusercontent.com/123980007/234171901-c1eb735e-ceca-481d-9310-02ba30f6836b.mp4 混淆器： root@kitploit: - 从远程服务器获取经过 XOR 处理的无文件 PE - 将加载器释放到磁盘 - 向该加载器添加随机节区 - 将经过 XOR 处理的无文件 PE 添加到新建的加载器节区 加载器：...

RTCore64-probe

此存储库没有 README。...

EUVD-2024-17210

Malicious code in bioql PyPI...

EUVD-2024-17195

Malicious code in bioql PyPI...

EUVD-2024-32318

Malicious code in bioql PyPI...

CVE-2024-3745

MSI Afterburner v4.6.6.16381 Beta 3 is vulnerable to an ACL Bypass vulnerability in the RTCore64.sys driver, which leads to triggering vulnerabilities like CVE-2024-1443 and CVE-2024-1460 from a low privileged user...

CVE-2024-3745 MSI Afterburner v4.6.6.16381 Beta 3 - ACL Bypass

MSI Afterburner v4.6.6.16381 Beta 3 is vulnerable to an ACL Bypass vulnerability in the RTCore64.sys driver, which leads to triggering vulnerabilities like CVE-2024-1443 and CVE-2024-1460 from a low privileged user...

CVE-2024-3745

MSI Afterburner v4.6.6.16381 Beta 3 is affected by an ACL Bypass in the RTCore64.sys driver, enabling escalation from a low-privilege user and potentially triggering CVE-2024-1443 and CVE-2024-1460. The CVE entry is supported by multiple sources (NVD, CVE lists) with CVSSv3.1 metrics showing LOCA...

CVE-2024-3745 MSI Afterburner v4.6.6.16381 Beta 3 - ACL Bypass

MSI Afterburner v4.6.6.16381 Beta 3 is vulnerable to an ACL Bypass vulnerability in the RTCore64.sys driver, which leads to triggering vulnerabilities like CVE-2024-1443 and CVE-2024-1460 from a low privileged user...

PT-2024-27563 · Msi · Msi Afterburner

Name of the Vulnerable Software and Affected Versions: MSI Afterburner version 4.6.6.16381 Beta 3 Description: The issue is related to an ACL Bypass vulnerability in the RTCore64.sys driver, which can lead to incorrect authorization and potentially compromise the local system. Recommendations:...

CVE-2024-1460

MSI Afterburner v4.6.5.16370 is vulnerable to a Kernel Memory Leak vulnerability by triggering the 0x80002040 IOCTL code of the RTCore64.sys driver. The handle to the driver can only be obtained from a high integrity process...

CVE-2024-1443

MSI Afterburner v4.6.5.16370 is vulnerable to a Denial of Service vulnerability by triggering the 0x80002000 IOCTL code of the RTCore64.sys driver. The handle to the driver can only be obtained from a high integrity process...

CVE-2024-1460

MSI Afterburner v4.6.5.16370 is vulnerable to a Kernel Memory Leak vulnerability by triggering the 0x80002040 IOCTL code of the RTCore64.sys driver. The handle to the driver can only be obtained from a high integrity process...

CVE-2024-1443

MSI Afterburner v4.6.5.16370 is vulnerable to a Denial of Service vulnerability by triggering the 0x80002000 IOCTL code of the RTCore64.sys driver. The handle to the driver can only be obtained from a high integrity process...

Memory corruption

MSI Afterburner v4.6.5.16370 is vulnerable to a Kernel Memory Leak vulnerability by triggering the 0x80002040 IOCTL code of the RTCore64.sys driver. The handle to the driver can only be obtained from a high integrity process...

Code injection

MSI Afterburner v4.6.5.16370 is vulnerable to a Denial of Service vulnerability by triggering the 0x80002000 IOCTL code of the RTCore64.sys driver. The handle to the driver can only be obtained from a high integrity process...