SharpHide - Tool To Create Hidden Registry Keys

Just a nice persistence trick to confuse DFIR investigation. Uses NtSetValueKey native API to create a hidden null terminated registry key. This works by adding a null byte in front of the UNICODESTRING key valuename. More info about this technique can be found in the following whitepaper:...

Design/Logic Flaw

Ghost Security Suite alpha 1.200 does not properly validate certain parameters to System Service Descriptor Table SSDT function handlers, which allows local users to cause a denial of service crash and possibly gain privileges via the 1 NtCreateKey, 2 NtCreateThread, 3 NtDeleteValueKey, 4...

CVE-2007-5040

CVE-2007-5040 affects Ghost Security Suite alpha 1.200. The issue is improper validation of certain parameters to System Service Descriptor Table (SSDT) function handlers, leading to denial of service (crash) and potential privilege elevation via kernel SSDT hooks. Affected kernel interfaces incl...

CVE-2007-4967

Online Armor Personal Firewall 2.0.1.215 does not properly validate certain parameters to System Service Descriptor Table SSDT function handlers, which allows local users to cause a denial of service crash and possibly gain privileges via unspecified kernel SSDT hooks for Windows Native API...

CVE-2007-4969

CVE-2007-4969 affects Process Monitor 1.22. The vulnerability stems from improper validation of parameters to System Service Descriptor Table (SSDT) function handlers, enabling local users to crash the system and potentially gain privileges via unspecified kernel SSDT hooks for Windows Native API...

CVE-2007-4970

ProcessGuard 3.410 is vulnerable due to improper validation of parameters passed to System Service Descriptor Table (SSDT) function handlers. The issue enables local users to trigger a denial of service (crash) and potentially gain privileges by abusing kernel SSDT hooks targeting Windows Native ...

Code injection

cmdmon.sys in Comodo Firewall Pro formerly Comodo Personal Firewall 2.4.16.174 and earlier does not validate arguments that originate in user mode for the 1 NtCreateSection, 2 NtOpenProcess, 3 NtOpenSection, 4 NtOpenThread, and 5 NtSetValueKey hooked SSDT functions, which allows local users to...