BlackLotus-analysis-stage2-bootkit-rootkit-stage

BlackLotus-analysis-stage2-bootkit-rootkit-stage BlackLotus stage 2 bootkit-rootkit analysis Before we dive into this divine shitbelive me this is some divine shit as nobody can do this withouth GOD's Willat least that's my opinion on this ,here's the hash for the bootkit file Frist things first...

CVE-2022-21894

baton drop CVE-2022-21894: Secure Boot Security Feature Bypass Vulnerability Windows Boot Applications allow the truncatememory setting to remove blocks of memory containing "persistent" ranges of serialised data from the memory map, leading to Secure Boot bypass. The truncatememory BCD element...

The vulnerability in the implementation of the Secure Boot protocol for operating systems with security features allows a perpetrator to circumvent security restrictions.

The vulnerability of the Secure Boot security loading protocol for Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions by installing a malicious file with the extension .bcd...

PT-2024-2779 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a buffer overflow in the Secure Boot protocol implementation of Windows operating systems. This could allow a remote attacker to bypass security restrictions using a...

PT-2024-2781 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to the implementation of the Secure Boot protocol in Windows operating systems, specifically due to insufficient input validation. This can allow a remote attacker to...

Microsoft Windows: Allow Secure Boot for integrity validation

This policy setting allows you to configure whether Secure Boot will be allowed as the platform integrity provider for BitLocker operating system drives. Secure Boot ensures that the PC Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, a...

[CVE-2015-2552] Windows 8+ - Trusted Boot Security Feature Bypass Vulnerability

Vulnerability title Microsoft: Trusted Boot Security Feature Bypass Vulnerability CVE: CVE-2015-2552 Vendor: Microsoft Product: Windows NT series 8.0+ Affected versions: See "systems affected". Reported by: "Myria" Vulnerability Summary: ===================== An attacker with administrative acces...

Microsoft Trusted Boot Security Feature Bypass

Vulnerability title Microsoft: Trusted Boot Security Feature Bypass Vulnerability CVE: CVE-2015-2552 Vendor: Microsoft Product: Windows NT series 8.0+ Affected versions: See "systems affected". Reported by: "Myria" Vulnerability Summary: ===================== An attacker with administrative acces...

MS15-111: Security Update for Windows Kernel to Address Elevation of Privilege (3096447)

The remote Windows host is affected by the following vulnerabilities : - Multiple elevation of privilege vulnerabilities exist in the Windows kernel due to improper handling of objects in memory. A local attacker can exploit these vulnerabilities, via a specially crafted application, to execute...