WinPmem

WinPmem -- 物理メモリ取得ツール WinPmem は長年にわたり、Windows向けのデフォルトのオープンソースメモリ取得ドライバーでした。以前はRekallプロジェクトに含まれていましたが、最近独自のリポジトリに分離されました。 これは Windows 版です。 Linux 版の Linpmem はこちら: https://github.com/Velocidex/Linpmem Copyright このコードは元々Google内で開発されましたが、Apache Licenseのもとで公開されました。 Description WinPmem...

physmem2profit

Physmem2profit Physmem2profit 可用于通过远程分析物理内存来创建目标主机 LSASS 进程的 minidump。本研究的目的是提出一种凭证窃取的替代方法，并创建一个模块化框架，以便扩展支持其他可以访问物理内存的驱动程序。Physmem2profit 会生成 LSASS 的 minidump（.dmp），可进一步使用 Mimikatz 进行分析。该工具不要求使用 Cobalt Strike，但应能通过带有 SOCKS 代理的 beacon 正常工作。 思路如下图所示： 该工具包含两个组件： 1. C 服务端组件 physmem2profit.exe，在目标主机上...

EUVD-2024-33562

Malicious code in bioql PyPI...

EUVD-2024-51042

Malicious code in bioql PyPI...

CVE-2024-12668

Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability. By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the...

CVE-2024-10972

Velocidex WinPmem versions 4.1 and below suffer from an Improper Input Validation vulnerability whereby an attacker with admin access can trigger a BSOD with a parallel thread changing the memory’s access right under the control of the user-mode application. This is due to verification only being...

CVE-2024-12668 Velocidex WinPmem Out of Bounds Write Vulnerability

Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability. By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the...

CVE-2024-12668

Velocidex WinPmem

CVE-2024-12668 Velocidex WinPmem Out of Bounds Write Vulnerability

Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability. By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the...

CVE-2024-12668 Velocidex WinPmem Out of Bounds Write Vulnerability

Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability. By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the...

CVE-2024-10972

Velocidex WinPmem (versions 4.1 and earlier) suffers from an Improper Input Validation vulnerability. The root cause is verification only at the start of a routine, enabling a userspace process with admin privileges to change memory page permissions mid-execution, potentially triggering a BSOD vi...

CVE-2024-10972 WinPmem Improper Input Validation vulnerability

Velocidex WinPmem versions 4.1 and below suffer from an Improper Input Validation vulnerability whereby an attacker with admin access can trigger a BSOD with a parallel thread changing the memory’s access right under the control of the user-mode application. This is due to verification only being...

CVE-2024-10972 WinPmem Improper Input Validation vulnerability

Velocidex WinPmem versions 4.1 and below suffer from an Improper Input Validation vulnerability whereby an attacker with admin access can trigger a BSOD with a parallel thread changing the memory’s access right under the control of the user-mode application. This is due to verification only being...

CVE-2024-10972 WinPmem Improper Input Validation vulnerability

Velocidex WinPmem versions 4.1 and below suffer from an Improper Input Validation vulnerability whereby an attacker with admin access can trigger a BSOD with a parallel thread changing the memory’s access right under the control of the user-mode application. This is due to verification only being...

WinPmem 安全漏洞

WinPmem is an open source physical memory acquisition tool from Velocidex. A security vulnerability exists in WinPmem versions prior to 4.1, which stems from an information leak in the inPmem driver. An attacker can exploit the vulnerability to discover the location of the gCiOptions global symbo...

WinPmem 安全漏洞

WinPmem is an open source physical memory acquisition tool from Velocidex. A security vulnerability exists in WinPmem version 4.1 and earlier versions that stems from improper validation of input...

PT-2024-17709 · Velocidex · Velocidex Winpmem

Name of the Vulnerable Software and Affected Versions: Velocidex WinPmem versions below 4.1 Description: The issue allows a user space program to trick the driver into writing a 0 into any chosen memory location by using an IO Control. In conjunction with information leakage from the WinPmem...

CSIRT-Collect - PowerShell Script To Collect Memory And (Triage) Disk Forensics

A PowerShell script to collect memory and triage disk forensics for incident response investigations. The script leverages a network share, from which it will access and copy the required executables and subsequently upload the acquired evidence to the same share post-collection. Permission...

Gargamel - A Forensic Evidence Acquirer

A Forensic Evidence Acquirer Compile Assuming you have Rust 1.41+ installed. Open terminal in the project directory and to compile a release build type cargo build --release Debug build can be compiled using cargo build Compiled executable is located at target/release/gargamel.exe or...