ntfstool

ntfstool NTFSTool is a forensic tool focused on NTFS volumes. It supports reading partition info MBR, partition table, VBR but also information on Master File Table, Bitlocker encrypted volume, EFS encrypted files, USN journal and more. Download the latest binaries on AppVeyor or by checking the...

rpc2wc

RPC 到 WebClient 关于此代码的信息可以在这篇博客文章中找到。建议在尝试使用这里的任何内容之前先阅读该文章。 用于通过 RPC 调用触发 WebClient 的代码。由于最终未能成功，代码从未被很好地整理，并且很大程度上仍停留在概念验证状态。 这些 RPC 调用能够到达启动服务的代码路径： EfsRpcDuplicateEncryptionInfoFileDownlevel - EfsDuplicateEncryptionInfoRPCClient - EfsDuplicateEncryptionInfoClient - EfspGetFullName -...

PetitPotam

PetitPotam NTLM 中继攻击检测 一个用于检测通过 Petit Potam 漏洞利用触发 NTLM 中继攻击尝试的 Zeek 软件包。 该软件包将检测看似成功和失败的漏洞利用尝试。它通过检查 EFS DCERPC 函数调用的返回代码来区分这两者。 注意：该软件包仅检测通过未加密 SMB 传输的漏洞利用尝试。通过加密 SMB 进行的 DCERPC 调用将不会被检测到。在这些情况下，有时可以通过检查 ntlm.log 输出来 寻找正在进行的成功 NTLM 中继攻击的迹象。 安装 安装此软件包最简单的方式是通过 zkg： zkg install corelight/petitpot...

CVE-2026-103505

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the...

EUVD-2026-90883

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the...

CVE-2026-103505 AWS EFS CSI Driver Mount Option Injection via mounttargetipmap

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the...

CVE-2026-103505

The AWS EFS CSI Driver (aws-efs-csi-driver ) versions v3.1.0 through v3.4.2 are vulnerable to an improper neutralization of argument delimiters within the volume handling component. This flaw could allow remote authenticated users who possess PersistentVolume creation permissions to inject arbitr...

CVE-2026-103505 AWS EFS CSI Driver Mount Option Injection via mounttargetipmap

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the...

CVE-2026-103505 AWS EFS CSI Driver Mount Option Injection via mounttargetipmap

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the...

EFS_CVE-2021-43217

EFS Bypass VulnerabilityCVE-2021-43217 Objective This vulnerability demonstration aimed to establish a controlled environment for simulating an EFS bypass on windows 10 through Kali Linux. The primary focus was to perform a vulnerability pentration and show the possiblity of controlling a desktop...

PT-2026-103904

Name of the Vulnerable Software and Affected Versions AWS EFS CSI Driver aws-efs-csi-driver versions 3.1.0 through 3.4.2 Description Improper neutralization of argument delimiters in the volume handling component allows remote authenticated users with PersistentVolume creation permissions to inje...

Amazon Linux 2 : amazon-efs-utils (ALAS-2026-3948)

The version of amazon-efs-utils installed on the remote host is prior to 3.3.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3948 advisory. RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-ti...

PetitPotam-notest

PetitPotam NTLM 中继攻击检测 一个 Zeek 包，用于检测通过 PetitPotam 漏洞触发 NTLM 中继攻击的尝试。 该包将检测看似成功和失败的漏洞利用尝试。它通过检查 EFS DCERPC 函数调用的返回码来 区分二者。 注意： 此包仅检测通过未加密 SMB 传输的漏洞利用尝试。通过加密 SMB 传输的 DCERPC 调用将不会被检测到。在这些情况下，有时可以检查 ntlm.log 的输出，寻找正在进行的成功 NTLM 中继攻击的迹象。 安装 安装此包最简单的方式是通过 zkg： zkg install corelight/petitpotam 使用 使用...

CVE-2026-85781

A flaw was found in the Amazon EFS Container Storage Interface CSI Driver. When the controller is configured with the non-default --delete-access-point-root-dir=true option, it does not verify that the EFS access point referenced by a PersistentVolume's volumeHandle belongs to the file system...

CLEANSTART-2026-KK52429 Security fix for CVE-2025-1767 applied in: aws-efs-csi-driver 2.2.0-r1, calico-fips 3.31.2-r1, ip-masq-agent 2.12.6-r1, pulumi-kubernetes-operator 2.7.0-r0

CVE-2025-1767 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-69841

Heap-based buffer overflow in Windows Encrypting File System EFS allows an authorized attacker to elevate privileges locally...

CVE-2026-69794

Buffer over-read in Windows Encrypting File System EFS allows an authorized attacker to disclose information locally...

CVE-2026-69688

Heap-based buffer overflow in Windows Encrypting File System EFS allows an authorized attacker to elevate privileges over a network...

EUVD-2026-73600

Buffer over-read in Windows Encrypting File System EFS allows an authorized attacker to disclose information locally...

CVE-2026-69794

CVE-2026-69794 is a buffer over-read in Windows Encrypting File System (EFS) that allows an authorized local attacker to disclose information . The flaw resides within the EFS component and results in a confidentiality impact with no integrity or availability impact. The CVSS 3.1 base score is 5....