UnderlayCopy

UnderlayCopy UnderlayCopy is a PowerShell utility for low-level NTFS acquisition and dumping protected, locked system artifacts for example: SAM , SYSTEM , NTDS.dit , registry hives , and other files that are normally inaccessible while Windows is running. It supports two complementary modes to...

tscopy

TScopy Updated 2022-03-31 Introducing TScopy It is a requirement during an Incident Response IR engagement to have the ability to analyze files on the filesystem. Sometimes these files are locked by the operating system OS because they are in use, which is particularly frustrating with event logs...

tscopy

TScopy Actualizado 2022-03-31 Presentando TScopy Durante un compromiso de Respuesta a Incidentes IR, es necesario tener la capacidad de analizar archivos en el sistema de archivos. A veces, estos archivos están bloqueados por el sistema operativo SO porque están en uso, lo que es particularmente...

CVE-2023-36424

Information ============== Windows Kernel Pool clfs.sys Corruption Privilege Escalation. CVE-2023-36424 This repo contains technical analysis & working exploit. Author: Nassim Asrir @p1k4l4 || https://www.linkedin.com/in/nassim-asrir-b73a57122/ Vulnerability ================ There is a pool...

CVE-2024-44193

Hacking Windows through iTunes - Local Privilege Escalation 0-day Introducing CVE-2024–44193 This is a write up on CVE-2024–44193 which is a Local Privilege Escalation exploit in iTunes version 12.13.2.3. It was patched September 12, 2024 by Apple. Link to Apple's Security Advisory: Apple's...

ntfstool

ntfstool NTFSTool es una herramienta forense centrada en volúmenes NTFS. Permite leer información de partición MBR, tabla de particiones, VBR así como información sobre Master File Table, volúmenes cifrados con Bitlocker, archivos cifrados con EFS, diario USN y más. Descarga los últimos binarios ...

CVE-2021-43229

CVE-2021-43229 Walkthrough Public information Windows NTFS Elevation of Privilege Vulnerability Unique from: CVE-2021-43230 CVE-2021-43231 Patch: Dec 14, 2021 According to @AravGarg3 on Twitter, CVE-2021-43229 seems to be exploitable and related to an integer overflow. Source :...

CVE-2020-16938

CVE-2020-16938 CVE-2020-16938 is a vulnerability that allows you to get unrestricted file read capabilities on the entire disk as unprivileged user. The bug was originally found and reported by my friend Jonas. His PoC can be found here. My version of the exploit consists of a bunch of Windows AP...

RawCopy

Introducción Esta es una aplicación de consola que copia archivos de volúmenes NTFS mediante un método de lectura de bajo nivel del disco. Sintaxis RawCopy /ImageFile:FullPath\ImageFilename /ImageVolume:1,2...n /FileNamePath:FullPath\Filename /OutputPath:FullPath /AllAttr:0|1 /RawDirMode:0|1|2...

CVE-2026-48095

CVE-2026-48095 7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer GetCuSize shift UB, potentially allowing attackers to cause arbitrary code execution or...

ntfsDump

ntfsDump Use to copy a file from an NTFS partitioned volume by reading the raw volume and parsing the NTFS structures. Similar to https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Invoke-NinjaCopy.ps1 Reference:https://www.codeproject.com/Articles/81456/An-NTFS-Parser-Lib...

CVE-2019-9702_Symantec_Encryption_Desktop_LPE_PoC

Symantec Encryption Desktop PGPwded.sys local privilege escalation PoC This repository contains a proof-of-concept for a local privilege escalation path in Symantec Encryption Desktop's PGPwded.sys storage filter, based on a low-privileged raw disk read/write primitive. The PoC was developed and...

CVE-Writeups

CVE-Writeups Security vulnerability research writeups. CVE-2026-50402: Windows NTFS Elevation of Privilege CVSS 7.8...

CVE-2026-33825

🔵 CVE-2026-33825 — “BlueHammer” 🔵 Microsoft Defender Local Privilege Escalation LPE BlueHammer is a high-severity Local Privilege Escalation vulnerability affecting Microsoft Defender components on Windows systems. The flaw allows a low-privileged attacker to escalate privileges to NT...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can lead to a out-of-bounds read in ntfsielookup in NTFS-3G before version 2021.8.22...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Additional checks have been added in ntfsfilerelease...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can lead to a out-of-bounds access vulnerability in the ntfsdecompress function in NTFS-3G, version 2021.8.22...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: A possible null pointer dereference has been fixed in niclear. In a previous commit c1006bd13146, ni-mi.mrec in niwrite inode could be NULL. Therefore, a NULL check was added for this variable. However, in the same call...

Astra Linux – Vulnerability in Linux 5.15

A issue was discovered in the Linux kernel before version 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, resulting in an out-of-bounds read in the ntfssetea function in fs/ntfs3/xattr.c...

CVE-2026-89614

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...