DarkLoadLibrary

DarkLoadLibrary LoadLibrary for offensive operations. How does it work? https://www.mdsec.co.uk/2021/06/bypassing-image-load-kernel-callbacks/ Usage DARKMODULE DarkModule = DarkLoadLibrary LOADLOCALFILE, // control flags L"TestDLL.dll", // local dll path, if loading from disk NULL, // dll buffer ...

ProcessInjection

ProcessInjection The program is designed to perform process injection. Currently the tool supports 5 process injection techniques. 1 Vanilla Process Injection 2 DLL Injection 3 Process Hollowing 4 APC Queue 5 KernelCallbackTable Injection The tool accepts shellcode in 4 formats. 1 base64 2 hex 3 ...

herpaderping

Process Herpaderping png.HerpaderpIcon Process Herpaderping is a method of obscuring the intentions of a process by modifying the content on disk after the image has been mapped. This results in curious behavior by security products and the OS itself. !png.mimioogle !gif.SurivDemo Summary...

CVE-2021-1732

CVE-2021-1732 The vulnerability occurs in the Windows graphics driver win32kfull!NtUserCreateWindowEx function due to a desynchronization between kernel callback user-mode memory allocation and the setting of the tagWND-flag attribute. This allows an attacker to forge the tagWND-offset value,...

CVE-2024-21338-Exploit

CVE-2024-21338 Exploit Project Introduction This is a POC for CVE-2024-21338, a privilege escalation vulnerability in the Windows AppLocker driver appid.sys. It was exploited as a 0-day by the Lazarus group for local privilege escalation on Windows. Vulnerability Background CVE-2024-21338 is a...

CVE-2026-17053 SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state

The SMBus driver API exposed smbussmbalertremovecb and smbushostnotifyremovecb as Zephyr syscalls. Their verifiers in drivers/smbus/smbushandlers.c validated only the dev argument with KSYSCALLOBJdev, KOBJDRIVERSMBUS and forwarded the caller-supplied struct smbuscallback cb pointer into kernel-mo...

CVE-2026-17053 SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state

The SMBus driver API exposed smbussmbalertremovecb and smbushostnotifyremovecb as Zephyr syscalls. Their verifiers in drivers/smbus/smbushandlers.c validated only the dev argument with KSYSCALLOBJdev, KOBJDRIVERSMBUS and forwarded the caller-supplied struct smbuscallback cb pointer into kernel-mo...

CVE-2026-17053 SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state

The SMBus driver API exposed smbussmbalertremovecb and smbushostnotifyremovecb as Zephyr syscalls. Their verifiers in drivers/smbus/smbushandlers.c validated only the dev argument with KSYSCALLOBJdev, KOBJDRIVERSMBUS and forwarded the caller-supplied struct smbuscallback cb pointer into kernel-mo...

CVE-2026-17053

The Zephyr RTOS SMBus driver API contains a vulnerability where smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() are exposed as syscalls. These syscalls fail to perform K_SYSCALL_MEMORY_READ/WRITE validation on the caller-supplied struct smbus_callback *cb pointer, forwarding it direc...

EUVD-2026-59409

In the Linux kernel, the following vulnerability has been resolved: kcm: use WRITEONCE when changing lower socket callbacks kcmattach replaces a live lower TCP socket's skdataready and skwritespace callbacks with KCM handlers, and kcmunattach restores them later. Those callback-pointer updates ar...

Win32k Callback Detouring: Abusing Legitimate Kernel-to-User Callback Dispatch for Code Execution

This injection technique abuses the kernel-to-user callback dispatch path used by the Windows graphical subsystem win32k.sys to obtain code execution inside a remote process. By locating the KernelCallbackTablethrough the target process's Process Environment Block PEB, an operator can enumerate...

Linux Distros Unpatched Vulnerability : CVE-2022-49506

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add vblank register/unregister callback functions We encountered a kernel pani...