TiEtwAgent

TiEtwAgent - ETW-based process injection detection This project was created to research, build and test different memory injection detection use cases and bypass techniques. The agent utilizes Microsoft-Windows-Threat-Intelligence event tracing provider, as a more modern and stable alternative to...

Microsoft Windows Cloud Files Mini Filter Driver CldiStreamCompleteRequest use-after-free vulnerability

Summary A use-after-free vulnerability exists in the CldiStreamCompleteRequest functionality of Windows Cloud Files Mini Filter Driver versions: 10.0.26100.8457 WinBuild.160101.0800. A specially crafted sequence of Cloud Filter API calls can lead to privilege escalation. An attacker can execute a...

CVE-2025-61155

CVE-2025-61155 — Arbitrary Process Termination in GameDriverX64.sys A signed kernel-mode anti-cheat driver — GameDriverX64.sys, shipped with Tower of Fantasy Hotta Studio / Perfect World — lets any unprivileged local user terminate arbitrary processes , including PPL-protected antivirus/EDR...

HyperDbg

HyperDbg Debugger HyperDbg Debugger is an open-source, hypervisor-assisted debugger for Windows Linux support is currently under development! with support for both user-mode and kernel-mode native debugging. It is built for reverse engineering, fuzzing, and advanced system analysis using modern...

FalconEye

FalconEye: Real-time detection software for Windows process injections FalconEye is a windows endpoint detection software for real-time process injections. It is a kernel-mode driver that aims to catch process injections as they are happening real-time. Since FalconEye runs in kernel mode, it...

systeminformer

System Informer A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc...

NtWarden

NtWARden Windows Analysis and Research Toolkit Windows system inspection tool built on ImGui + DirectX 11. Covers processes, services, network, kernel internals, and more - locally or over the network via WinSysServer. ⚠️ Parts of this project were vibe coded with AI assistance so it might have...

DIRT

DIRT: Driver Initial Reconnaissance Tool I'm writing this tool to learn C++ and get an initial assessment of drivers installed on a Windows system e.g. master images developed by OEMs or enterprises. It's supposed to help with target selection, finding low-hanging fruit, and some assistance with...

wmi-static-spoofer

wmi-static-spoofer Motivation: The initial motivation is bypassing HWID detection methods used by intrusive software like anti-cheats, etc. or licensing restrictions implemented in software. The concept is not new but other solutions require a loaded driver at all times and a kernel hook with...

CVE-2026-85921

Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...

CVE-2026-85921

CVE-2026-85921 is a double free vulnerability in Windows Secure Kernel Mode that allows an authorized attacker to elevate privileges locally . The CVSS 3.1 score is 8.2 (HIGH) with a local attack vector, low complexity, high privileges required, and changed scope , resulting in high impact to con...

VectorKernel

VectorKernel PoCs para investigación o educación en técnicas de rootkits en modo kernel. Actualmente enfocado en el sistema operativo Windows. Todos los módulos son compatibles solo con sistemas operativos de 64 bits de la familia x64. Entorno Todos los módulos se prueban en Windows 11 x64. Para...

aegis

Aegis カーネルモードのプロセス保護ドライバー。ObRegisterCallbacks を使用して、ハンドルからのメモリアクセス許可を剥奪します。基本的な実装であり、ハンドル作成をフックし、不正なアクセス試行から PROCESSVMREAD/WRITE/OPERATION を削除します。 注: GIFがアニメーションしない場合は、Imgurで直接表示してください。 概要 ドライバーは高度 321123 でOBコールバックを登録し、OBOPERATIONHANDLECREATE および OBOPERATIONHANDLEDUPLICATE...

Windows Secure Kernel Mode Elevation of Privilege Vulnerability

Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...

CVE-2024-21305

CVE-2024-21305 This repo contains the report and PoC of CVE-2024-21305, the non-secure Hypervisor-Protected Code Integrity HVCI configuration vulnerability. This vulnerability allowed arbitrary kernel-mode code execution, effectively bypassing HVCI, within the root partition. For the root cause,...

backdoors

后门 本项目包含用于维持系统访问的工具，以及 Hacker House 团队编写的概念验证演示。这些工具旨在模拟或演示常见的持久化技术，例如内核模式挂钩及命令与控制（C2）实现。 文件| 描述 ---|--- bindshell.go| 使用 GoLang 编写的绑定 shell 示例 bindshell.py| 使用 Python 编写的绑定 shell 示例 cmdbot.py| 通过 IRC C2 执行命令的 Python 机器人 filehider.tgz| 用于隐藏文件的 Linux 内核模块 halloween.py| Python 脚本追加器 VX 注入 PoC...

CVE-2016-7255

CVE-2016-7255 Microsoft Windows Vista SP2、Windows Server 2008 SP2およびR2 SP1、Windows 7 SP1、Windows 8.1、Windows Server 2012 GoldおよびR2、Windows RT 8.1、Windows 10 Gold、1511、1607、Windows Server 2016のカーネルモードドライバにより、ローカルユーザーが細工されたアプリケーションを介して特権を昇格できる脆弱性があります。別名「Win32k 特権昇格の脆弱性」。 リビア出身、17歳のGihad...

r0ak

r0ak r0ak es una utilidad de línea de comandos de Windows que permite leer, escribir y ejecutar código en modo kernel con algunas limitaciones desde el símbolo del sistema, sin necesidad de nada más que privilegios de Administrador. Primer vistazo root@kitploit: r0ak v1.0.0 -- Ring 0 Army Knife...

PINKPANTHER

PINKPANTHER Brief Windows x64 kernel-mode handcrafted shellcode to replace primary access token of executing process with SYSTEM process token for Elevation of PrivilegeEoP. Supported OS Versions Windows 7/Windows Server 2008 R2 Build 7601 Windows 8/Windows Server 2012 Build 9200 Windows...

access_updated

Singular Access Updated fork ofbtbd/access with Zydis-based dynamic pattern finding for Windows 10/11 compatibility A kernel-mode syscall wrapper that enables privileged process operations without requiring handles. Uses xKdEnumerateDebuggingDevices pointer hooking for kernel-usermode...