85 matches found
SharpAppLocker
SharpAppLocker C 移植的 PowerShell cmdlet Get-AppLockerPolicy，具有扩展功能。包括过滤和搜索特定类型规则和操作的能力。当你已初步绕过AppLocker且不想留下PowerShell日志时非常有用。 寻找预编译版本？请查看 https://github.com/Flangvik/SharpCollection 项目！ / | | / \ | | | | \ --.| | / /\ \ | | | | --. \ ' \ / | '| ' | | ' | ' | | / \ / | |/ / \ '| // / | | | | | |...
Empire
Empire Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers. The Empire server is written in Python 3 and is modular to allow operator flexibility. Empire comes built-in with a client that can be used remotely to access the server...
EDR-GhostLocker
GhostLocker：基于 AppLocker 的 EDR 中和工具 介绍 在我关于 Fairy-Law 的文章中，我使用内核缓解措施来禁用端点检测与响应 EDR 解决方案，diversenok 指出 IFEO 排除项（映像文件执行选项）对第三方应用程序过于侵入。这引出了一个更好的方法：利用管理员通过 AppLocker 已经拥有的内在权力。 该概念受 diversenok 启发，他指出管理员可以合法地控制其系统上的任何软件。基于这一见解，我开发了一种使用 AppLocker 作为原生 Windows 控制机制的技术。这项研究探索了 AppLocker 用于 EDR 控制的技术实现...
CVE-2024-21338-Exploit
CVE-2024-21338 Exploit 项目简介 这是一个针对 CVE-2024-21338 的 POC，该漏洞是 Windows AppLocker 驱动（appid.sys）中的一个提权漏洞，曾作为 0day 被 Lazarus 组织利用，用于 Windows 本地权限提升。 漏洞背景 CVE-2024-21338 是一个在 2024 年 2 月 13 日微软 Patch Tuesday 中被披露的提权漏洞，该漏洞被 Lazarus 黑客组织利用，用于获取内核访问权限，以部署 FudModule rootkit。 该漏洞存在于 appid.sys...
BOF-pack-1
BOF-pack-1 面向红队交战的实用 BOF 补给包 GetAppLockerPolicy 打印该域的有效 AppLockerPolicy TokenElevate 使用 winlogon 的令牌创建进程（默认启用 Tcb Privilege，并包含其他 winlogon 特定特权）。这是在管理员上下文中无需使用 SCM 即可提升到 SYSTEM 的替代方法。 PrivChanger 在当前或远程进程中禁用和启用多个令牌特权。...
Get-AppLockerEventlog
Get-AppLockerEventlog 描述 此脚本将解析来自 Windows 事件日志的所有通道，提取与 AppLocker 相关的所有日志。该脚本将收集事件相关的所有重要信息，用于取证、威胁狩猎甚至故障排除。以下是我们从 Windows 事件日志中获取的日志： EXE 和 DLL, MSI 和脚本, 打包的应用部署, 打包的应用执行。 输出： 结果将在屏幕上显示 并且，结果将保存到 CSV 文件：AppLocker-log.csv 使用此脚本你将获得的详细实用信息包括： FileType, EventID, Message, User, Computer, EventTime,...
The vulnerability of the Applocker Filter Driver (applockerfltr.sys) in the Windows operating system allows a hacker to increase their privileges.
The vulnerability of the Applocker Filter Driver applockerfltr.sys in the Windows operating system is related to synchronization errors when using common resources. Exploiting this vulnerability can allow an attacker to increase their privileges...
CVE-2026-25184
Concurrent execution using shared resource with improper synchronization 'race condition' in Applocker Filter Driver applockerfltr.sys allows an authorized attacker to elevate privileges locally...
EUVD-2026-22367
Concurrent execution using shared resource with improper synchronization 'race condition' in Applocker Filter Driver applockerfltr.sys allows an authorized attacker to elevate privileges locally...
CVE-2026-25184
Concurrent execution using shared resource with improper synchronization 'race condition' in Applocker Filter Driver applockerfltr.sys allows an authorized attacker to elevate privileges locally...
CVE-2026-25184 Applocker Filter Driver (applockerfltr.sys) Elevation of Privilege Vulnerability
...
CVE-2026-25184 Applocker Filter Driver (applockerfltr.sys) Elevation of Privilege Vulnerability
...
CVE-2026-25184
Technical details about CVE-2026-25184 are not publicly provided in the supplied documents. No information on affected products, targeted components, impact, or fixes is available here. Monitor for updates.
Applocker Filter Driver (applockerfltr.sys) Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization 'race condition' in Applocker Filter Driver applockerfltr.sys allows an authorized attacker to elevate privileges locally...
Microsoft Applocker Filter Driver 竞争条件问题漏洞
The Microsoft Applocker Filter Driver is a component developed by Microsoft that is used in Windows operating systems to implement application control. The Microsoft Applocker Filter Driver applockerfltr.sys has a race condition vulnerability. Attackers can exploit this vulnerability to gain...
CVE-2026-25184: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization 'race condition' in Applocker Filter Driver applockerfltr.sys allows an authorized attacker to elevate privileges locally...
PT-2026-32728
Name of the Vulnerable Software and Affected Versions Applocker Filter Driver applockerfltr.sys affected versions not specified Description A race condition occurs in the Applocker Filter Driver applockerfltr.sys due to concurrent execution using a shared resource with improper synchronization...
EUVD-2011-4363
Malware in sbrugna...
CVE-2011-4434
Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 do not properly enforce AppLocker rules, which allows local users to bypass intended access restrictions via a 1 macro or 2 scripting feature in an application, as demonstrated by Microsoft Office applications and the...
