4885 matches found
memory-forensic
memory-forensic A memory forensics toolkit that profiles Windows kernels itself — and is cross-checked, process-for-process, against Volatility 3. mem4n6 reads every common dump format LiME, AVML, ELF core, Windows crash dumps, hibernation files, VMware save-states, kdump, raw… and walks processe...
CVE-2024-43630-POC
CVE-2024-43630-POC This repository contains a POC that triggers a stack OOB write when executed, causing the system to crash. This vulnerability is an extremely interesting and rare relic that demonstrates the complexities and peculiarities of kernel programming, especially object management...
CVE-2017-11882-Blocker
CVE-2017-11882-Blocker A Windows driver that neutralizes CVE-2017-11882 : How it works This project is split into a kernel driver and a user-mode notification component that talk over a custom device using the inverted call model. Kernel driver 1. Process callback - DriverEntry registers a...
CVE-2024-30088
CVE-2024-30088 This repository contains a Proof of Concept PoC written in Python for the vulnerability CVE-2024-30088. This code is an attempt to replicate the vulnerability as a technical exercise, with purely educational and demonstrative purposes, showing how Python somehow "struggles" also in...
CVE-2025-62454
This is not exploiting, just POC BUGCHECKCODE: 50 BUGCHECKP1: ffff808b75973000 BUGCHECKP2: 2 BUGCHECKP3: fffff803df12ddda BUGCHECKP4: 0 READADDRESS: ffff808b75973000 Special pool MMINTERNALCODE: 0 IMAGENAME: cldflt.sys MODULENAME: cldflt FAULTINGMODULE: fffff803df110000 cldflt PROCESSNAME:...
Driver-HideKernelThread-IoCancelIrp
Driver-HideKernelThread-IoCancelIrp 不是我的代码。仅用于保存 https://bbs.pediy.com/thread-272795.htm 原理 将线程入口地址设置为 IoCancelIrp，并将上下文设置为你创建的 irp。 然后线程将调用 IoCancelIrp。当被调用时，将执行取消 IRP 的操作。 这将进而调用 IRP-CancelRoutine。所以我们只需要将自己的线程入口地址设置为 IRP-CancelRoutine。 如何检测？ 检测起始入口地址是否为 IoCancelIrp。 向系统线程插入 APC 并遍历栈。...
The vulnerability of the Windows Kernel component in operating systems allows attackers to enhance their privileges.
The vulnerability of the Windows Kernel component in operating systems involves the possibility of exploiting memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...
CVE-2026-85360
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally...
CVE-2026-83942
Missing authorization in Windows Kernel allows an authorized attacker to elevate privileges locally...
CVE-2026-69900
Untrusted pointer dereference in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally...
CVE-2026-69723
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information over a network...
CVE-2026-69669
Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to execute code over a network...
CVE-2026-69578
Numeric truncation error in Windows Kernel allows an authorized attacker to elevate privileges locally...
CVE-2026-69473
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally...
CVE-2026-69466
Time-of-check time-of-use toctou race condition in Windows Kernel allows an authorized attacker to elevate privileges locally...
CVE-2026-69421
Integer underflow wrap or wraparound in Windows Kernel Mode Driver allows an authorized attacker to elevate privileges locally...
CVE-2026-69406
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally...
CVE-2026-69366
Use after free in Windows Kernel allows an authorized attacker to elevate privileges over a network...