Blackout

Blackout leveraging gmer driver to effectively disabling or killing EDRs and AVs. it bypass HVCI fluently the sample is sourced from loldrivers https://www.loldrivers.io/drivers/7ce8fb06-46eb-4f4f-90d5-5518a6561f15/ usage Place the driver Blackout.sys in the same path as the executable The...

NimBlackout

NimBlackout Note : This project is for educational purposes only. The use of this code for any malicious activity is strictly prohibited. I am not responsible for any misuse of this software. NimBlackout is an adaptation of the @Blackout project originally developed in C++ by @ZeroMemoryEx, which...

SharpBlackout

SharpBlackout Terminate AV/EDR leveraging BYOVD attack Note: This project is for educational purposes only. Sharpblackout is an adaptation of the @Blackout project originally developed in C++ by @ZeroMemoryEx, which consists of removing AV/EDRs using the gmer BYOVD driver. Just wanted to try maki...

EUVD-2016-5289

Malware in sbrugna...

CVE-2016-4289

A stack based buffer overflow vulnerability exists in the method receiving data from SysTreeView32 control of the GMER 2.1.19357 application. A specially created long path can lead to a buffer overflow on the stack resulting in code execution. An attacker needs to create path longer than 99...

CVE-2016-4289

A stack based buffer overflow vulnerability exists in the method receiving data from SysTreeView32 control of the GMER 2.1.19357 application. A specially created long path can lead to a buffer overflow on the stack resulting in code execution. An attacker needs to create path longer than 99...

Stack overflow

A stack based buffer overflow vulnerability exists in the method receiving data from SysTreeView32 control of the GMER 2.1.19357 application. A specially created long path can lead to a buffer overflow on the stack resulting in code execution. An attacker needs to create path longer than 99...

CVE-2016-4289

The CVE-2016-4289 issue is confirmed in GMER where data from SysTreeView32 is handled with a TVITEM buffer that is too small for Unicode paths. The root cause is a 200-character ANSI-sized buffer (cchTextMax = 0xC8) used when the code ultimately calls SendMessageA with TVM_GETITEMW, which treats ...

CVE-2016-4289

A stack based buffer overflow vulnerability exists in the method receiving data from SysTreeView32 control of the GMER 2.1.19357 application. A specially created long path can lead to a buffer overflow on the stack resulting in code execution. An attacker needs to create path longer than 99...

CVE-2016-4289: Out-of-bounds Write

A stack based buffer overflow vulnerability exists in the method receiving data from SysTreeView32 control of the GMER 2.1.19357 application. A specially created long path can lead to a buffer overflow on the stack resulting in code execution. An attacker needs to create path longer than 99...

GMER Path Length Code Execution Vulnerability(CVE-2016-4289)

Summary A stack based buffer overflow vulnerability exists in the method receiving data from SysTreeView32 control of the GMER application. A specially created long path can lead to a buffer overflow on the stack resulting in code execution. An attacker needs to create path longer than 99...

GMER Stack Buffer Overflow Vulnerability

GMER is a program for detecting and removing rootkits. GMER suffers from a stack buffer overflow vulnerability due to the program failing to adequately validate user-supplied data. Allowing an attacker to exploit the vulnerability would allow execution of arbitrary code within the context of the...

GMER 1.0.15.15641 MFT Overwrite

No description provided by source. include stdio.h include windows.h include winioctl.h include stdlib.h include string.h / Program : GMER 1.0.15.15641 Homepage : http://www.gmer.net Discovery : 2011/08/01 Author Contacted : 2011/08/09 Status of vuln : 0day Found by : Heurs This Advisory : Heurs...

GMER 1.0.15.15641 MFT Overwrite

include include include include include / Program : GMER 1.0.15.15641 Homepage : http://www.gmer.net Discovery : 2011/08/01 Author Contacted : 2011/08/09 Status of vuln : 0day Found by : Heurs This Advisory : Heurs Contact : [email protected] //----- Application description GMER is an application...

GMER 1.0.15.15641 - MFT Overwrite

include include include include include / Program : GMER 1.0.15.15641 Homepage : http://www.gmer.net Discovery : 2011/08/01 Author Contacted : 2011/08/09 Status of vuln : 0day Found by : Heurs This Advisory : Heurs Contact : [email protected] //----- Application description GMER is an application...

GMER 1.0.15.15641 - MFT Overwrite

GMER 1.0.15.15641 - MFT Overwrite include include include include include / Program : GMER 1.0.15.15641 Homepage : http://www.gmer.net Discovery : 2011/08/01 Author Contacted : 2011/08/09 Status of vuln : 0day Found by : Heurs This Advisory : Heurs Contact : [email protected] //----- Application...

GMER 1.0.15.15641 MFT Overwrite

Exploit for windows platform in category dos / poc include include include include include / Program : GMER 1.0.15.15641 Homepage : http://www.gmer.net Discovery : 2011/08/01 Author Contacted : 2011/08/09 Status of vuln : 0day Found by : Heurs This Advisory : Heurs Contact : email protected //---...

GMER - Automating Rootkit Analyzer Released

GMER - Automating Rootkit Analyzer Released GMER is an application that detects and removes rootkits . It scans for: hidden processes hidden threads hidden modules hidden services hidden files hidden disk sectors MBR hidden Alternate Data Streams hidden registry keys drivers hooking SSDT drivers...