Hunt-Weird-Syscalls

Hunt-Weird-Syscalls This is a ETW based POC to monitor for abnormal syscalls. For now, the syscalls NtOpenThread and NtSetContextThread are monitored to identify IOCs indicating both direct and indirect syscalls. Description This project uses ETW, more precisely kernel based ETW providers, to...

CVE-2007-5086

CVE-2007-5086 concerns Kaspersky Anti-Virus/Internet Security 7.0.0.125 where SSDT and Shadow SSDT parameter validation is insufficient, enabling local users to trigger a crash (DoS) via kernel hooks in kylif.sys (NtUserSendInput, LoadLibraryA, NtOpenProcess, NtOpenThread, NtTerminateProcess, NtU...

Code injection

Privatefirewall 5.0.14.2 does not properly validate certain parameters to System Service Descriptor Table SSDT function handlers, which allows local users to cause a denial of service crash and possibly gain privileges via kernel SSDT hooks for 1 NtOpenProcess and 2 NtOpenThread...

CVE-2007-4967

Online Armor Personal Firewall 2.0.1.215 does not properly validate certain parameters to System Service Descriptor Table SSDT function handlers, which allows local users to cause a denial of service crash and possibly gain privileges via unspecified kernel SSDT hooks for Windows Native API...

CVE-2007-4968

CVE-2007-4968 – Normal mode \n\nAffected product: Privatefirewall 5.0.14.2.\nWhat is vulnerable: the system service descriptor table (SSDT) function handlers are not properly validated for certain parameters, enabling an attacker with local access to trigger a denial of service (crash) and potent...

CVE-2007-4968: Improper Input Validation

Privatefirewall 5.0.14.2 does not properly validate certain parameters to System Service Descriptor Table SSDT function handlers, which allows local users to cause a denial of service crash and possibly gain privileges via kernel SSDT hooks for 1 NtOpenProcess and 2 NtOpenThread...

Code injection

cmdmon.sys in Comodo Firewall Pro formerly Comodo Personal Firewall 2.4.16.174 and earlier does not validate arguments that originate in user mode for the 1 NtCreateSection, 2 NtOpenProcess, 3 NtOpenSection, 4 NtOpenThread, and 5 NtSetValueKey hooked SSDT functions, which allows local users to...