166 matches found
dumpguard_bof
DumpGuard BOF DumpGuard 的 Beacon Object File BOF 移植，用于从现代 Windows 系统的会话中提取 NTLMv1 哈希。 关于本项目 本仓库包含 DumpGuard 的 Beacon Object File BOF 实现，从原始的 C/.NET 实现移植到纯 C 语言，以便在 Havoc 和其他支持 BOF 执行的 C2 框架中使用。 这是一个概念验证 PoC 和学习练习。 这个 BOF 移植是我个人学习远程凭据保护协议、Kerberos 身份验证流程以及底层 Windows 安全机制细节的一部分。将该工具从 C 移植到纯 C 以用于 B...
DumpGuard
DumpGuard DumpGuard 是一款针对现代 Windows 系统的凭据转储与协议研究工具。它滥用 Remote Credential Guard 协议，即使在启用了 Credential Guard 的情况下也能恢复凭据材料，同时还包含了一条用于面向会话的 NTLM 提取的 Microsoft v1 身份验证包路径。 当前功能包括： NTLMv1 响应 NTLMv2 响应 Kerberos 服务票据 用于本地登录会话的 Microsoft v1 身份验证包转储 你可以从本仓库的发布版块下载预构建的二进制文件。 免责声明：...
BypassCredGuard
BypassCredGuard - Credential Guard Bypass Via Patching Wdigest Memory Background Adam Chester @xpn wrote an article called "Exploring Mimikatz - Part 1 - WDigest" about memory patching to enable UseLogonCredential and make Wdigest cache cleartext credentials intrigued me. The wdigest.dll module...
CVE-2026-72958
Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally...
CVE-2026-70578
Heap-based buffer overflow in Windows Credential Guard allows an authorized attacker to elevate privileges locally...
EUVD-2026-73655
Heap-based buffer overflow in Windows Credential Guard allows an authorized attacker to elevate privileges locally...
CVE-2026-70578
CVE-2026-70578 is a heap-based buffer overflow in Windows Credential Guard that allows an authorized local attacker to elevate privileges . The Microsoft-assigned CVSS 3.1 score is 7.0 (High) , with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H , indicating local access, high attack complexity,...
EUVD-2026-73115
Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally...
CVE-2026-72958
CVE-2026-72958 is a double free vulnerability in Windows Credential Guard that allows an authorized attacker to elevate privileges locally . The flaw resides in the Credential Guard component of Windows, a security feature that isolates user credentials from the rest of the operating system. The ...
NativeBypassCredGuard
NativeBypassCredGuard NativeBypassCredGuard is a tool designed to bypass Credential Guard by patching WDigest.dll using only NTAPI functions exported by ntdll.dll. It is available in two flavours: C and C++. The tool locates the pattern "39 ?? ?? ?? ?? 00 8b ?? ?? ?? ?? 00" in the WDigest.dll fil...
Windows Credential Guard Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Credential Guard allows an authorized attacker to elevate privileges locally...
Windows Credential Guard Elevation of Privilege Vulnerability
Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally...
lazarus-sigma-rules
Reglas Sigma de Lazarus Las reglas Sigma en este repositorio fueron creadas por el equipo de Detección y Respuesta Countercept de F-Secure para proporcionar cobertura de detección para las Herramientas, Técnicas y Procedimientos utilizados recientemente por el Grupo Lazarus. Las publicaciones del...
CVE-2026-64111
A flaw was found in the Linux kernel's Security Module LSM. A local attacker could exploit this vulnerability by leveraging an improper handling of a credential guard mutex in the lsmsetselfattr function. This oversight may allow the attacker to bypass security restrictions enforced by modules su...
CVE-2026-64111 lsm: hold cred_guard_mutex for lsm_set_self_attr()
In the Linux kernel, the following vulnerability has been resolved: lsm: hold credguardmutex for lsmsetselfattr Just as procpidattrwrite already does before calling the LSM hook. This only matters for SELinux and AppArmor which check whether the process is being ptraced and if so, whether to allo...
CVE-2026-64111
The CVE-2026-64111 issue affects the Linux kernel where lsm_set_self_attr() did not hold cred_guard_mutex in the same way as proc_pid_attr_write() before calling the LSM hook. The fix ensures the mutex is held, reducing risk related to SELinux and AppArmor decisions based on whether a process is ...
EUVD-2026-3111
Microsoft Edge Elevation Service exposes a privileged COM interface that inadequately validates the privileges of the calling process. A standard non‑administrator local user can invoke the IElevatorEdge interface method LaunchUpdateCmdElevatedAndWait, causing the service to execute privileged...
CVE-2026-21223
Improper privilege management in Microsoft Edge Chromium-based allows an authorized attacker to bypass a security feature locally...