LOLBAS

Living Off The Land Binaries and Scripts and now also Libraries All the different files can be found behind a fancy frontend here: https://lolbas-project.github.io thanks @ConsciousHacker for this bit of eyecandy and the team over at https://gtfobins.github.io/. This repo serves as a place where ...

DSCourier

DSCourier 설명 DSCourier는 Microsoft 서명된 바이너리를 통해 DSC 구성을 적용하기 위해 WinGet Configuration COM API를 사용하는 개념 증명입니다. 별도의 블로그 게시물에서 이 기술에 대한 전체 기술 심층 분석을 제공합니다. DSCourier는 주로 연구 주제로 구축되었으며, 완성된 도구라기보다는 개념 증명으로 보아야 합니다. 그 가치의 대부분은 운영자가 직접 구성 파일을 생성하는 등 수정, 확장 및 실험하는 데서 비롯됩니다. 이 연구 프로젝트는 호기심과 재미로 만들어졌으며 악의적으...

CVE-2022-42046

EvilWfshbr CVE-2022-42046 wfshbr64.sys ローカル特権昇格の概念実証 wfshbr64.sys および wfshbr32.sys の特別に細工されたペイロードにより、任意のユーザーが任意の EPROCESS オフセットとフラグ値に対してビット演算を実行し、EPROCESS.Protection および EPROCESS.SignatureLevel フラグを操作することでゲームプロセスを意図的に CodeGen Full 保護に昇格させることができます（機能としてのセキュリティホール）。 このドライバーは、Microsoft Hardware...

lolbin-poc

lolbin-poc Microsoftの署名済み実行ファイルをlolbinとして使用する小さなPoCです。 ビルド（32ビット） root@kitploit: cmake -B build32 -A Win32 cmake --build build32 --config Release ビルド（64ビット） root@kitploit: cmake -B build64 -A x64 cmake --build build64 --config Release 使い方 WinDbgをここからダウンロードし、windbg.exeの隣にコンパイル済みのdbgeng.dllを置きます。 お...

CVE-2026-25250

🕷️ CVE-2026-25250: 信頼されたブートローダーチェーン検証の不備 署名または整合性検証なしでセカンダリEFIバイナリを読み込む、Microsoft署名のサードパーティ製ブートローダー。内部からSecure Bootの信頼チェーンを崩壊させます。 📑 目次 研究背景 公式リファレンス 自分で再現する 脆弱なブートチェーン 脆弱性の概要 📂 Secure Bootと信頼モデル 根本原因分析 悪用プロセス 緩和策と失効 🧠 研究背景...

PT-2026-33497

Name of the Vulnerable Software and Affected Versions Microsoft-signed third-party bootloader affected versions not specified Description A security-feature bypass allows attackers to affect the system. A Microsoft-signed third-party bootloader completely skips signature verification when loading...

New Fake CAPTCHA Scam Abuses Microsoft Tools to Install Amatera Stealer

Another day, another fake CAPTCHA scam, but this one abuses Microsoft’s signed tools...

K000152613: Secure Boot Bypass vulnerability CVE-2025-3052

Security Advisory Description An arbitrary write vulnerability in Microsoft signed UEFI firmware allows for code execution of untrusted software. This allows an attacker to control its value, leading to arbitrary memory writes, including modification of critical firmware settings stored in NVRAM...

CVE-2025-3052

CVE-2025-3052 is an arbitrary write vulnerability in Microsoft-signed UEFI firmware caused by the improper handling of the IhisiParamBuffer NVRAM variable. Attackers can use this primitive to modify critical firmware structures, specifically the global gSecurity2 parameter, leading to a Secure Bo...

CVE-2025-3052: Undefined Security Weakness

An arbitrary write vulnerability in Microsoft signed UEFI firmware allows for code execution of untrusted software. This allows an attacker to control its value, leading to arbitrary memory writes, including modification of critical firmware settings stored in NVRAM. Exploiting this vulnerability...

shim security update

shim - 15.8-2.0.3.el7 - Set shim.ol sbat generation to 3 Orabug: 36271343 - 15.8-2.0.1.el7 - Set SBATAUTOMATICDATE to 2021030218 Orabug: 36271343 - Rebuild with Oracle certificates Orabug: 36271343 - Full list of fixed CVEs: CVE-2023-40546, CVE-2023-40547, CVE-2023-40548, CVE-2023-40549,...

Chinese Hackers Deploy Microsoft-Signed Rootkit to Target Gaming Sector

Cybersecurity researchers have unearthed a novel rootkit signed by Microsoft that's engineered to communicate with an actor-controlled attack infrastructure. Trend Micro has attributed the activity cluster to the same actor that was previously identified as behind the FiveSys rootkit, which came ...

Ransomware Attackers Use Microsoft-Signed Drivers to Gain Access to Systems

Microsoft on Tuesday disclosed it took steps to implement blocking protections and suspend accounts that were used to publish malicious drivers that were certified by its Windows Hardware Developer Program. The tech giant said its investigation revealed the activity was restricted to a number of...

High-Severity Windows UAC Flaw Enables Privilege Escalation

Researchers disclosed details of a high-severity Microsoft Windows vulnerability that could give attackers elevated privileges – ultimately allowing them to install programs, and view, change or delete data. The bug stems from User Account Control UAC, a security feature of Windows within Secure...

Applocker Evasion - Windows Presentation Foundation Host

This module will assist you in evading Microsoft Windows Applocker and Software Restriction Policies. This technique utilises the Microsoft signed binary PresentationHost.exe to execute user supplied code. This module requires Metasploit: https://metasploit.com/download Current source:...

LOLBAS - Living Off The Land Binaries And Scripts (LOLBins And LOLScripts)

The goal of the LOLBAS project is to document every binary, script, and library that can be used for Living Off The Land techniques. All the different files can be found behind a fancy frontend here: https://lolbas-project.github.io thanks @ConsciousHacker for this bit of eyecandy and the team ov...

Manipulating Microsoft WSUS to Own Enterprises

LAS VEGAS – Windows Server Update Services WSUS is your friend, if you run an enterprise IT shop, because it facilitates the download and distribution of security patches, service pack installations and hardware driver updates among others. Two researchers this week at the Black Hat conference,...

microsoft-install.txt

Juan asked me to forward this message from him to the list. He has discovered that an ActiveX control shipped with IE can be used to install software components signed by Microsoft without prompting the user. This of curse raises trust issues. Someone, not necessarily Microsoft, could use this...