allthingsida

オペレーティングシステム MS Windows PEB/LDRDATATABLEENTRY 列挙スクリプト PEB/TEB 構造体 x64 PEB/TEB 構造体 x86...

beagle

Beagle 1. About Beagle 2. Installation 1. Docker 2. Python Package 3. Configuration 3. Web Interface 1. Uploading Data 2. Browsing Existing Graphs 3. Graph Interface 1. Inspecting Nodes and Edges 2. Expanding Neighbours 3. Hiding Nodes 4. Running Mutators 5. Toggling Node and Edge Types 6...

memOptix

memOptix このJupyterノートブックは、DFIRプロフェッショナルがWindowsメモリダンプのトリアージを行う際に役立つように作成されました。 このノートブックは、CrowdStrikeのSupermem...

SuperMem

概要 Windowsメモリイメージをトリアージタイプに基づいて処理するために開発されたPythonスクリプトです。 必要条件 Python3 Bulk Extractor Volatility2 with Community Plugins Volatility3 Plaso Yara 使用方法 クイックトリアージ python3 winSuperMem.py -f memdump.mem -o output/ -tt 1 フルトリアージ python3 winSuperMem.py -f memdump.mem -o output/ -tt 2 包括的トリアージ python3...

mimikatz

mimikatz mimikatz는 제가 C를 배우고 Windows 보안에 대한 몇 가지 실험을 하기 위해 만든 도구입니다. 현재는 메모리에서 평문 비밀번호, 해시, PIN 코드, Kerberos 티켓을 추출하는 것으로 잘 알려져 있습니다. mimikatz는 또한 pass-the-hash, pass-the-ticket 또는 Golden 티켓을 생성할 수 있습니다. root@kitploit: .. mimikatz 2.0 alpha x86 release "Kiwi en C" Apr 6 2014 22:02:03 . ^ . / \ / ...

Vol3xp

Vol3xp, Volatility 3 탐색기 플러그인 WinObj - Windows Kernel Objects Explorer는 https://github.com/kslgroup/WinObj의 개선판으로, volatility 3용 winobj.py WinObj WinObj sysinternals와 매우 유사 또한 Struct Analyzer와 VolExp의 WinObjGui를 지원합니다. RAMMap - 물리 주소 매핑 pfn.py RAMMap Rammap SysInternals와 매우 유사 하지만 추가로 의심스러운 페이지를...

mimikatz

mimikatz mimikatz は、C を学び、Windows セキュリティに関するいくつかの実験を行うために私が作ったツールです。 メモリから平文パスワード、ハッシュ、PIN コード、Kerberos チケットを抽出することでよく知られています。mimikatz は、pass-the-hash、pass-the-ticket の実行や ゴールデンチケット の作成も可能です。 root@kitploit: .. mimikatz 2.0 alpha x86 release "Kiwi en C" Apr 6 2014 22:02:03 . ^ . / \ / \ / Benjamin...

CVE-2025-71323 picklescan - Remote Code Execution via Unblocked ctypes Module

picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls and accessing raw memory. Attackers can craft malicious pickle files using ctypes.WinDLL to load kernel32.dll and execute arbitrary commands, bypassing sandbo...

CVE-2026-11281

Integer overflow in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted ETW event. Chromium security severity: Low...

CVE-2025-47761

An Exposed IOCTL with Insufficient Access Control vulnerability CWE-782 vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.9 may allow an authenticated local user to execute unauthorized code via fortips driver. Success of the attack would requi...

SAP GUI for Windows 安全漏洞

SAP GUI for Windows is an interface graphics software for Windows from SAP, Germany. A security vulnerability exists in SAP GUI for Windows that originates from an elevated privilege user being able to locally access sensitive information in the process memory at runtime, potentially resulting in...

EUVD-2019-1513

Malware in sbrugna...

The vulnerability of the BitLocker data protection function in Windows operating systems allows attackers to increase their privileges.

The vulnerability of the BitLocker data protection function in Windows operating systems relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to increase their privileges...

CVE-2025-8061

A potential insufficient access control vulnerability was reported in the Lenovo Dispatcher 3.0 and Dispatcher 3.1 drivers used by some Lenovo consumer notebooks that could allow an authenticated local user to execute code with elevated privileges. The Lenovo Dispatcher 3.2 driver is not affected...

CVE-2025-8061

CVE-2025-8061 affects Lenovo Dispatcher drivers 3.0 and 3.1 via the LnvMSRIO.sys driver, enabling local privilege escalation due to insufficient access control. The vulnerability allows an authenticated local user to execute code with elevated privileges; Lenovo Dispatcher 3.2 is not affected. Wi...

CVE-2024-23912

Out-of-bounds Read vulnerability in Merge DICOM Toolkit C/C++ on Windows. When MCOpenFile function is used to read a malformed DICOM data, it might result in over-reading memory buffer and could cause memory access violation...

The vulnerability of Windows operating systems relates to the use of memory after it is freed, allowing an attacker to increase their privileges.

Vulnerabilities of Windows operating systems are related to the use of memory after it is freed. Exploiting these vulnerabilities can allow attackers to increase their privileges...

The vulnerability of the SPNEGO security mechanism for Windows operating systems allows a perpetrator to disclose protected information.

The vulnerability of the SPNEGO security mechanism for Windows operating systems is related to reading data beyond the allowed range in memory. Exploiting this vulnerability can allow an attacker to disclose protected information...

PT-2025-1269 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to the Microsoft Digest authentication mechanism in Windows operating systems, which uses insecure methods for handling authentication data in the operating system's...

K15893: Apache HTTP server vulnerabilities CVE-2014-0117, CVE-2014-0118, CVE-2014-0226, CVE-2014-0231, and CVE-2014-3523

Security Advisory Description CVE-2014-0117 The modproxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service child-process crash via a crafted HTTP Connection header. CVE-2014-0118 The deflateinfilter function...