TopazTerminator

TopazTerminator F, Another driver got burned.. I was gatekeeping wsftprm.sys driver for a while ; but since someone posted a public POC, I'm ungatekeeping it. We all know it'll get added to the driver blocklist soon, so here's my implementation for the same — in C This project exploits the...

windows-kernel-exploits

windows-kernel-exploits Introduction windows-kernel-exploits Vulnerability List Security Bulletin KB Description Operating System CVE-2021-33739 Microsoft DWM Core Library Elevation of Privilege Vulnerability Windows 10, 20 CVE-2021-1732 Windows Win32k Elevation of Privilege Vulnerability Windows...

EtwLeakKernel

EtwLeakKernel This repository contains a PoC for a program that utilizes ETW to leak kernel memory addresses. It does so by creating a consumer could be to almost any provider as almost all of them leak kernel addresses and requesting a stack trace from it. Once the stack trace is received, it is...

CVE-2024-49138-POC

CVE-2024-49138-POC Fix Error Decombine root@kitploit: C:\Program Files\Microsoft Visual Studio\2022\Professional\MSBuild\Microsoft\VC\v170\Microsoft.CppBuild.targets456,5: error MSB8020: The build tools for Visual Studio 2019 Platform Toolset = 'v142' cannot be found. To build using the v142 buil...

drift-corpus

The Drift Corpus: Ring 0 Drift Corpus is the definitive, open-source repository of Windows Kernel patch diffs. These artifacts are produced using Drift Agent , ByteRay's automatic reverse engineering engine and part of the Argus-Systems platform. With Drift, we have successfully mapped, analyzed,...

CVE-2025-62215_Windows_Kernel_PE

CVE-2025-62215 Exploit PoC Original code credit: https://github.com/dexterm300 🧨 Description This repository contains a proof-of-concept exploit for CVE-2025-62215 , a race condition vulnerability in the Windows kernel that can be triggered via concurrent manipulation of kernel object handles...

AutoPiff

AutoPiff Automated Patch Intelligence and Finding Framework A semantic analysis engine for detecting vulnerability fixes in Windows kernel driver patches. AutoPiff uses conservative YAML rules to identify security-relevant code changes with high precision and explainability. Overview AutoPiff...

rewind

README Rewind es un fuzzer guiado por cobertura basado en instantáneas que se dirige a componentes del kernel de Windows. La idea es partir de una instantánea de un sistema en ejecución. Esta instantánea se compone de las páginas de memoria física junto con el estado de la CPU. Este estado se...

nmap-CVE-2022-21907

nmap-CVE-2022-21907 Repositorio que contiene un script nse para la vulnerabilidad CVE-2022-21907. Es una vulnerabilidad de un componente IIS en Windows. Permite la ejecución remota de código. La vulnerabilidad afecta al módulo del kernel http.sys, que maneja la mayoría de las operaciones básicas ...

MS17-010

MS17-010 Como toda nuestra investigación está ahora en el repositorio master de Metasploit, no había razón para confundir a todos manteniendo este repositorio abierto, ya que había dos versiones de todo y, debido a la abrumadora popularidad, el soporte se convirtió en una pesadilla, pues esto es...

CVE-2021-31955-POC

CVE-2021-31955 Windows内核信息泄露 POC 该漏洞利用适用于所有存在漏洞的64位系统。 未修补系统 已修补系统...

CVE-2025-54110-Kernel-EoP-PoC

CVE-2025-54110-Kernel-EoP-PoC PoC implementation for CVE-2025-54110 a Kernel-Level Integer Overflow Vulnerability in the Windows NtQueryDirectoryObject system call. CVE-2025-54110 - Windows Kernel Integer Overflow Analysis CVE: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54110...

CVE_2025_24257----NOT-MINE

🔧 CVE202524257----NOT-MINE - 安全运行Windows PoC 🧾 概述 CVE202524257----NOT-MINE 是一个Windows概念验证程序，展示了IOGPUFamily中的一个内核内存错误。它基于一个bitmapmask下溢问题，可能导致内核堆越界写入。该项目是与该问题相关的首个公开PoC。 本仓库面向那些希望下载该软件包、在Windows上打开并尽可能少配置地运行示例的用户。本README的目标是让非技术用户也能轻松完成操作。 📥 下载 使用此链接访问项目页面并下载文件： 前往下载页面...

fibratus

Fibratus Security sensor for realtime threat detection and protection Get Started » Docs • Rules • Filaments • Download • Discussions Fibratus detects and eradicates advanced attacker tradecraft, malware, and emerging threats by scrutinizing and asserting a wide spectrum of system events against ...

CVE-2025-62215-POC

CVE-2025-62215 — Windows Token UAF（SepTokenSidSharingEnabled 竞态条件） 本仓库仅用于教育和研究目的。 概述 在 Windows 内核的 SepTokenSidSharingEnabled 优化路径中发生的一个 Use-After-Free 漏洞 PoC。 当 NtDuplicateToken 将 SID Values Block 的 RefCount 从 1 增加到 2 时， 一个竞态内核线程通过 ExFreePoolWithTag 释放了该块。 随后 SepDereferenceSidValuesBlock 访问已释放的块 ...

CVE-2019-0803

CVE-2019-0803 Win32k 权限提升 PoC 截图 参考资料 窃取安全令牌 https://github.com/mwrlabs/CVE-2016-7255...

CVE-2024-30088-Windows-poc

CVE-2024-30088-Windows-poc This vulnerability exists in the NtQueryInformationToken function, specifically when handling the AuthzBasepCopyoutInternalSecurityAttributes function. It originates from improper management of the locking mechanism by the kernel when operating on objects. This flaw cou...

Driver-HideKernelThread-IoCancelIrp

Driver-HideKernelThread-IoCancelIrp no es mi código. solo para guardarlo https://bbs.pediy.com/thread-272795.htm Principio Establece la dirección de entrada del hilo en IoCancelIrp y el contexto en el irp que creaste. Entonces el hilo llamará a IoCancelIrp. cuando sea llamado, realizará la...

matrix-rs

Hipervisor Type-2 Blue Pill del núcleo de Windows en Rust Nombre en clave: Matrix Blog: https://memn0ps.github.io/hypervisors-for-memory-introspection-and-reverse-engineering/ Un hipervisor de investigación tipo 2 basado en Rust, ligero, seguro en cuanto a memoria y extremadamente rápido, con hoo...

HyperDeceit

HyperDeceit Este repositorio contiene el código fuente completo del proyecto HyperDeceit, que es una librería que te permite hacerte pasar por Hyper-V e interceptar las hiperllamadas realizadas por el kernel de Windows. Entrada del blog: https://reversing.info/posts/hyperdeceit/ Aviso legal El...