CVE-2024-26229-BOF

CVE-2024-26229 BOF CVE-2024-26229的Beacon Object File实现——通过DKOM令牌窃取实现Windows CSC驱动程序本地权限提升。 基于RalfHacker/CVE-2024-26229-exploit，转换为具有动态函数解析DFR的BOF，用于与支持Cobalt Strike BOF API的C2框架一起使用。 工作原理 1. 通过NtCreateFile打开\Device\Mup;Csc..以获取CSC驱动程序句柄 2. 发送IOCTL 0x001401a3...

Exploit for Heap-based Buffer Overflow in Microsoft

CVE-2024-26229 BOF Beacon Object File implementation of CVE-2...

PT-2024-2982

Name of the Vulnerable Software and Affected Versions Windows CSC Service affected versions not specified Description The issue is related to an elevation-of-privilege vulnerability in the Windows CSC Service, which can be exploited due to improper address validation in IOCTL with METHOD NEITHER...