CVE-2025-26125

Description The PoC program exploits the IMFForceDelete driver which exposes an ioctl that allows unprivileged users to delete files and folders. We can turn this into a privilege escalation by using a technique explained by ZDI and Halov, which exploits the MSI rollback mechanism which is design...

Vision-MSI-Thermal-Control

Vision MSI Thermal Control MSI Modern 15H AI C1MG-096IT Linux thermal management - Reverse engineered EC control with fan profiles and battery threshold 🎯 Purpose of this Project This application was born out of necessity for MSI laptop users on Linux. The journey began when I discovered that...

CVE-2022-22077

✅ CVE-2022-22077 exploitation framework RTCore64.sys: This document provides a comprehensive overview of the CVE-2022-22077 exploitation framework, a sophisticated BYOVD Bring Your Own Vulnerable Driver attack toolkit that targets the RTCore64.sys driver vulnerability. This framework demonstrates...

GwisinMsi

GwisinMsi This repo contains the PoC of the MSI payload used in the blog post. The payload is based on the Gwisin ransomware's MSI payload analysis of the AhnLab ASEC team's blog post. DLL Compiling Configuration Project Project properties c/c++ preprocessor processor definition -...

CVE-2021-27965

CVE-2021-27965 MSI Dragon Center 2.0.98.0 之前版本中的 MsIo64.sys 驱动程序（1.1.19.1016 之前版本）存在缓冲区溢出漏洞，允许通过精心构造的 0x80102040、0x80102044、0x80102050 或 0x80102054 IOCTL 请求实现权限提升。 这个漏洞利用将会完成，这是保证。...

shakeitoff

shakeitoff A smaller, minimized, and cleaner version of InstallerFileTakeOver aka the zero-day exploit that is a "variation" of CVE-2021-41379 later assigned CVE-2021-43883. This version does not pop a shell like InstallerFileTakeOver. The point of this code was to create a simpler proof of conce...

msi-central_privesc

CVE-2022-38532 MSI Center 桌面应用程序中的本地权限提升。 该漏洞存在于 MSI.CentralServer.exe 的 "CFeatures" 中。MSI.CentralServer.exe 是一个收集系统信息的应用程序，它与 MSI.TerminalServer.exe 协作。我们可以在 "CMDAutoUpdateSDK" 中调用的 ExecuteTask 函数，使我们有机会以管理员权限运行带有自定义参数的可执行文件。相关端口只能从 localhost 访问。 漏洞详情 你可以使用任意 .NET 反编译器轻松反汇编...

CVE-2024-50804

CVE-2024-50804 Writeup can be found on my blog below. Thanks! https://g3tsyst3m.github.io/cve/msi/Arbitrary-Write-Privilege-Escalation-CVE-2024-50804/...

msidump

msidump MSI Dump – 一款用于分析恶意 MSI 安装包的工具，支持提取文件、流、二进制数据，并集成 YARA 扫描器。 对于启用了宏的 Office 文档，我们可以快速使用 oletools mraptor 判断文档是否恶意。如果希望进一步分析，可以使用 oletools olevba 或 oledump。 对于恶意 MSI 文件的分解，目前为止我们只有一个可靠且值得信赖的工具：lessmsi。 然而，lessmsi 并不具备我所需的功能： 快速分类 二进制数据提取 YARA 扫描 因此，msidump 应运而生。 特性 该工具有助于快速分类以及详细检查恶意 MSI...

msidump

msidump MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner. On Macro-enabled Office documents we can quickly use oletools mraptor to determine whether document is malicious. If we want to dissect it further, we...

msi-search

MSI Search Windows caches MSI files at C:\Windows\Installer\ with randomized filenames consisting of letters and numbers followed by the ".msi" extension. This tool simplifies the task for red team operators and security teams to identify which MSI files correspond to which software and enables...

MAL-002

MAL-002: Forzar el reinicio del sistema mediante MSIs de Windows instalados Una vez que un software se instala correctamente en el sistema, uno o más archivos MSI de confianza aparecerán en la carpeta “C:\Windows\Installer” y pueden permitir a un usuario de bajo privilegio realizar acciones de...

msiscan

MSI Analyzer Este script de Python para Linux puede analizar archivos instaladores de Microsoft Windows .msi y señalar posibles vulnerabilidades. Fue desarrollado por Michael Baer @derbaer0 en el SEC Consult Vulnerability Lab. Actualmente, está orientado principalmente a una escalada local de...

mindmanager-poc

mindmanager-poc Aplicación afectada: MindManager23setup.exe Plataforma: Windows Problema: Escalada local de privilegios mediante el modo de reparación del instalador MSI condición de carrera por secuestro de EXE Descubierto y reportado por: Pawel Karwowski y Julian Horoszkiewicz Eviden Red Team...

CVE-2019-16098

CVE-2019-16098 The driver in Micro-Star MSI Afterburner 4.6.2.15658 aka RTCore64.sys and RTCore32.sys allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. This can be exploited for privilege escalation, code execution under high privileges, and information...

NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE

NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE 此利用程序重建并利用了CVE-2019-16098漏洞。该漏洞位于Micro-Star MSI Afterburner...

CVE-2024-37726-MSI-Center-Local-Privilege-Escalation

CVE-2024-37726 MSI Center 本地权限提升 - 任意文件覆盖漏洞。...

CVE-2021-29337

CVE-2021-29337 - MODAPI.sys 中的权限提升 MSI Dragon Center 概述 受影响产品: MSI Dragon Center 受影响版本: 2.0.104.0 CVE MITRE 描述 Dragon Center 中的易受攻击的内核驱动程序 MODAPI.sys 暴露了 IOCTL 0x9C406104，该 IOCTL 允许低权限用户通过调用几个驱动程序例程之一（MmMapIoSpace）直接将物理内存映射到虚拟地址空间，从而与物理内存直接交互。 通过 DeviceIoControl 发送有效的输入和输出缓冲区，可以在最新的 Windows 10...

tu-TOCTOU-kaiu-TOCMEU-CVE-2020-13162-

Pulse Secure Windows Client https://www.redtimmy.com/privilege-escalation/pulse-secure-windows-client/ 和 https://www.redtimmy.com/privilege-escalation/pulse-secure-client-for-windows-9-1-6-toctou-privilege-escalation-cve-2020-13162/...

CVE-2026-78627

The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the...