kur

kur 这是一个简单的代码，可利用存在漏洞的已签名驱动程序，从用户模式进行内核模式内存读写。 它仅仅是在内核模式下利用 MmCopyVirtualMemory（一个未公开但最常见的 API 之一），从而无需担心内存页的保护机制，即可读取/写入任意用户模式内存。此外，它还附带一个函数，用于获取给定 PID 的进程句柄作为辅助功能。由于句柄的创建在内核模式下进行，我相信标准的访问检查和回调不会被触发。 本项目仅用于学习目的，不建议在虚拟机之外的环境中使用。 background 我在 uc 论坛上看到，这个特定驱动程序存在提权漏洞。 于是我开始亲自逆向该驱动程序，果然该驱动程序对其强大的...

CVE-2025-27535

Exposed ioctl with insufficient access control in the firmware for some IntelR Ethernet Connection E825-C. before version NVM ver. 3.84 within Ring 0: Bare Metal OS may allow a denial of service. System software adversary with a privileged user combined with a high complexity attack may enable...

Intel Ethernet Connection E825-C 安全漏洞

The Intel Ethernet Connection E825-C is a series of network controllers developed by the American company Intel. Versions of Intel Ethernet Connection E825-C prior to NVM ver. 3.84 contain security vulnerabilities. These vulnerabilities stem from insufficient ioctl access control, which may lead ...

CVE-2023-35841

Exposed IOCTL with Insufficient Access Control in Phoenix WinFlash Driver on Windows allows Privilege Escalation which allows for modification of system firmware.This issue affects WinFlash Driver: before 4.5.0.0...

PHOENIX CONTACT TdkLib64.sys 安全漏洞

PHOENIX CONTACT TdkLib64.sys is a core application from PHOENIX CONTACT, Germany. A security vulnerability exists in PHOENIX CONTACT TdkLib64.sys, which stems from the vulnerability of TdkLib64.sys to insufficient IOCTL access control, where by sending a specific IOCTL request, an attacker withou...