kurasagi

kurasagi kurasagi es un POC completo del bypass de PatchGuard para Windows 24H2 - 25H2. Para más información, consulta la rama product, que contiene el documento PDF que detalla el bypass. Si aparece algún BSOD relacionado conCRITICALSTRUCTURECORRUPTION PatchGuard, ¡crea un issue con él! Descargo...

EfiGuard

概述 EfiGuard 是一款便携式 x64 UEFI 启动工具包（bootkit），可在启动时修补 Windows 启动管理器、启动加载器和内核，以禁用 PatchGuard 和驱动程序签名强制（DSE）。 如果你只是想尝试 EfiGuard，请跳到使用。 功能特性 目前支持自 Vista SP1 至 Windows 11 所有已发布的与 EFI 兼容的 Windows x64 版本。 易于使用：可通过 U 盘或 Windows EFI 分区启动，加载器会自动查找并启动 Windows。驱动程序也可通过 UEFI Shell 或加载器手动加载和配置。 大量使用 Zydis...

efiguard-detected

efiguard-detect 最简单的方法检查 EfiGuard 是否干掉了您的 PatchGuard。 工作原理 efiguard 在运行时留下了一个 SetVariable 后门——我们只需从用户态戳它一下，要求读取 ntoskrnl 基址处的 2 个字节。如果返回 MZ，则说明后门还在，efiguard 已完成其工作，PatchGuard 已失效。 局限性 仅当用户选择了默认的 DSE 绕过方法（DSEDISABLESETVARIABLEHOOK）时才有效——而这是默认设置。如果选择了 DSEDISABLEATBOOT，该钩子会在 ExitBootServices...

GDRVLoader

GDRVLoader - 在 Windows 10-11 上加载未签名驱动 最初基于 https://github.com/fengjixuchui/gdrv-loader，但进行了改进并支持最新的 Windows 版本。 新增功能 在 Windows 10-11 上加载未签名驱动，且不会被 PatchGuard 检测到。 通过添加脆弱驱动的字节加载功能，提升了可移植性。 CRT 兼容性，代码更简洁，使用更便捷。 简单易用的命令行界面。 使用方法 1. 下载最新版本。 2. a 将目标驱动拖放到 GDRVLoader.exe 上。 b 使用管理员权限在 cmd 中运行工具，命令为...

Bootlicker - A Generic UEFI Bootkit Used To Achieve Initial Usermode Execution

bootlicker is a legacy, extensible UEFI firmware rootkit targeting vmware hypervisor virtual machines. It is designed to achieve initial code execution within the context of the windows kernel, regardless of security settings configured. Architecture bootlicker takes its design from the legacy...

EfiGuard - Disable PatchGuard And DSE At Boot Time

EfiGuard is a portable x64 UEFI bootkit that patches the Windows boot manager, boot loader and kernel at boot time in order to disable PatchGuard and Driver Signature Enforcement DSE. Features Currently supports all EFI-compatible versions of Windows x64 ever released, from Vista SP1 to Server...

For a driver to mention the right vulnerability analysis-vulnerability warning-the black bar safety net

One, Foreword As Microsoft is constantly reinforcing core safety, enhance the native kernel components of the exploit difficulty, and now third party kernel drivers are gradually becoming the attacker's preferred target, is security analysts the focus of the study. Signed third-party driver...

On GhostHook, Fireball, WannaCry, and more

Mike Mimoso and Chris Brook discuss the news of the week, including Citizen Lab’s latest report, WannaCry hitting Honda, GhostHook, and Fireball. Download: ThreatpostNewsWrapJune232017.mp3 Music by Chris Gonsalves Show notes: GhostHook attack bypasses Windows 10 PatchGuard Say Goodbye to SMBv1 in...

New GhostHook Attack Bypasses Windows 10 PatchGuard Protections

Vulnerabilities discovered in Microsoft PatchGuard kernel protection could allow hackers to plant rootkits on computers running the company's latest and secure operating system, Windows 10. Researchers at CyberArk Labs have developed a new attack technique which could allow hackers to completely...

GhostHook Attack Bypasses Windows 10 PatchGuard

A bypass of PatchGuard kernel protection in Windows 10 has been developed that brings rootkits for the latest version of the OS within reach of attackers. Since the introduction of PatchGuard and DeviceGuard, very few 64-bit Windows rootkits have been observed; Windows 10’s security, in particula...

NSA's DoublePulsar Kernel Exploit In Use Internet-Wide

If you’re on a red team or have been on the receiving end of a pen-test report from one, then you’ve almost certainly encountered reports of Windows servers vulnerable to Conficker MS08-067, which has been in the wild now for nearly 10 years since the bug was patched. A little more than two weeks...

Secret Net 7 and Secret Net Studio 8 - Local Privilege Escalation

Secret Net 7 and Secret Net Studio 8 - Local Privilege Escalation Source: https://github.com/Cr4sh/secretnetexpl Secret Net 7 and Secret Net Studio 8 local privileges escalation exploit. 0day vulnerabilities in sncc0.sys kernel driver of Secrity Code products allows attacker to perform local...

Secret Net 7 and Secret Net Studio 8 - Privilege Escalation

Exploit for windows platform in category local exploits Source: https://github.com/Cr4sh/secretnetexpl Secret Net 7 and Secret Net Studio 8 local privileges escalation exploit. 0day vulnerabilities in sncc0.sys kernel driver of Secrity Code products allows attacker to perform local privileges...

Secret Net 7 and Secret Net Studio 8 - Local Privilege Escalation

Source: https://github.com/Cr4sh/secretnetexpl Secret Net 7 and Secret Net Studio 8 local privileges escalation exploit. 0day vulnerabilities in sncc0.sys kernel driver of Secrity Code products allows attacker to perform local privileges escalation from Guest to Local System. Also, attacker that...

Windows Vista/Server 2008 NtUserCheckAccessForIntegrityLevel Use-after-free Vulnerability

No description provided by source. Due to hostility toward security researchers, the most recent example being of Tavis Ormandy, a number of us from the industry and some not from the industry have come together to form MSRC: the Microsoft-Spurned Researcher Collective. MSRC will fully disclose...

Microsoft Windows Vista2008 - NtUserCheckAccessForIntegrityLevel Use-After-Free

Microsoft Windows Vista2008 - NtUserCheckAccessForIntegrityLevel Use-After-Free Windows Vista/Server 2008 NtUserCheckAccessForIntegrityLevel Use-after-free Vulnerability Intro: Due to hostility toward security researchers, the most recent example being of Tavis Ormandy, a number of us from the...

Microsoft Windows Vista/2008 - NtUserCheckAccessForIntegrityLevel Use-After-Free

Windows Vista/Server 2008 NtUserCheckAccessForIntegrityLevel Use-after-free Vulnerability Intro: Due to hostility toward security researchers, the most recent example being of Tavis Ormandy, a number of us from the industry and some not from the industry have come together to form MSRC: the...