CVE-2025-3464-AsIO3-LPE

CVE-2025-3464-AsIO3-LPE CVE-2025-3464: Unprivileged LPE exploit for ASUS AsIO3.sys - TOCTOU auth bypass + PreviousMode decrement CVE-2025-3464: AsIO3.sys Local Privilege Escalation This exploit will only work on Windows 11 22H2 or earlier. Microsoft fixed PreviousMode hijinks. Local privilege...

CVE-2020-16938

CVE-2020-16938 CVE-2020-16938 is a vulnerability that allows you to get unrestricted file read capabilities on the entire disk as unprivileged user. The bug was originally found and reported by my friend Jonas. His PoC can be found here. My version of the exploit consists of a bunch of Windows AP...

irflow-timeline

IRFlow Timeline Native macOS forensic timeline analysis. Import, search, and investigate EVTX, CSV, XLSX, Plaso, $MFT, $J, and local AI assistant artifacts — with AI Secret Hunt and the analytics DFIR professionals actually need. Built on Electron + SQLite to handle millions of rows without...

CVE-2024-44193

Hacking Windows through iTunes - Local Privilege Escalation 0-day Introducing CVE-2024–44193 This is a write up on CVE-2024–44193 which is a Local Privilege Escalation exploit in iTunes version 12.13.2.3. It was patched September 12, 2024 by Apple. Link to Apple's Security Advisory: Apple's...

tscopy

TScopy Updated 2022-03-31 Introducing TScopy It is a requirement during an Incident Response IR engagement to have the ability to analyze files on the filesystem. Sometimes these files are locked by the operating system OS because they are in use, which is particularly frustrating with event logs...

UnderlayCopy

UnderlayCopy UnderlayCopy is a PowerShell utility for low-level NTFS acquisition and dumping protected, locked system artifacts for example: SAM , SYSTEM , NTDS.dit , registry hives , and other files that are normally inaccessible while Windows is running. It supports two complementary modes to...

CVE-2021-31956-POC

" CVE-2021-31956" WIP PoC code for CVE-2021-31956 in preparation for OSEE. Will improve it further after my OSEE exams and free time. A lot of hardcoded offsets need to be changed if it is different on the target system but if it is anything similar to 2020 - 2021 builds then no change should be...

ntfstool

ntfstool NTFSTool is a forensic tool focused on NTFS volumes. It supports reading partition info MBR, partition table, VBR but also information on Master File Table, Bitlocker encrypted volume, EFS encrypted files, USN journal and more. Download the latest binaries on AppVeyor or by checking the...

ntfstool

ntfstool NTFSTool es una herramienta forense centrada en volúmenes NTFS. Permite leer información de partición MBR, tabla de particiones, VBR así como información sobre Master File Table, volúmenes cifrados con Bitlocker, archivos cifrados con EFS, diario USN y más. Descarga los últimos binarios ...

RawHive

RawHive RawHive is a Cobalt Strike BOF for pulling selected Windows registry hives directly from a raw NTFS volume. It skips the normal file APIs, walks NTFS metadata to find the target file records, and copies the bytes straight from disk. It currently looks for: C:\Windows\System32\config\SAM...

LogFileParser

Features Decode and dump $LogFile records and transaction entries. Decode NTFS attribute changes. Optionally resolve all datarun list information available in $LogFile. Option: "Reconstruct data runs". Recover transactions from slack space within $LogFile. Choose to reconstruct missing or damaged...

DriverJack

DriverJack Introduction DriverJack is a tool designed to load a vulnerable driver by abusing lesser-known NTFS techniques. These method bypass the registration of a Driver Service on the system by hijacking an existing service, and also spoof the image path presented in the Driver Load event. To...

RecuperaBit

RecuperaBit A software which attempts to reconstruct file system structures and recover files. Currently it supports only NTFS. RecuperaBit attempts reconstruction of the directory structure regardless of: missing partition table unknown partition boundaries partially-overwritten metadata quick...

The vulnerability of the NTFS file system in Windows operating systems allows attackers to increase their privileges.

The vulnerability of the NTFS file system in Windows operating systems relates to the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow a remote attacker to increase their privileges...

libfsntfs

libfsntfs is a library to access the New Technology File System NTFS format. Project information: Status: experimental Licence: LGPL-3.0-or-later Read-only supported NTFS formats: NTFS version 3.0 NTFS version 3.1 Supported NTFS format features: LZNT1 compression Windows Overlay Filter WOF...

analyzeMFT

AnalyzeMFT Status : All tests passing across Python 3.8-3.12 on Windows, macOS, and Linux. Quick Start Install pip install analyzeMFT Basic usage python analyzeMFT.py -f MFTFILE -o output.csv --csv Generate test MFT for testing python -c "from src.analyzeMFT.testgenerator import createtestmft;...

CVE-2026-41091-PoC-Exploit

CVE-2026-41091 - RedSun SolarFlare - Microsoft Defender LPE Exploit Legal Disclaimer & Responsible Use This tool is provided for educational and authorized penetration testing purposes only. The authors and contributors are not responsible for any misuse or damage caused by this software. Users a...

CVE-2021-43229

CVE-2021-43229 Walkthrough Public information Windows NTFS Elevation of Privilege Vulnerability Unique from: CVE-2021-43230 CVE-2021-43231 Patch: Dec 14, 2021 According to @AravGarg3 on Twitter, CVE-2021-43229 seems to be exploitable and related to an integer overflow. Source :...

plaso

Plaso Plaso Langar Að Safna Öllu - super timeline all the things Plaso Plaso Langar Að Safna Öllu, or super timeline all the things , is a Python-based engine used by several tools for automatic creation of timelines. Plaso default behavior is to create super timelines but it also supports creati...

CVE-2023-36424

Information ============== Windows Kernel Pool clfs.sys Corruption Privilege Escalation. CVE-2023-36424 This repo contains technical analysis & working exploit. Author: Nassim Asrir @p1k4l4 || https://www.linkedin.com/in/nassim-asrir-b73a57122/ Vulnerability ================ There is a pool...