ThrottleStopPPL

ThrottleStopPPL Windows Server 2022 上の Protected Process Light PPL 保護レベルを管理するための概念実証ツールです。ThrottleStop ドライバの脆弱性（CVE-2025-7771）を悪用します。 概要 このツールは、ThrottleStop ドライバによって公開された任意の物理メモリ読み取り/書き込み機能を介した特権昇格を示します。カーネルメモリ構造を直接操作することで、プロセス保護レベルの変更を可能にします。 特徴 任意の物理メモリ読み取り/書き込み Superfetch を介した仮想アドレスから物理アドレスへの変...

BYOVD-CVE-2023-52271-POC

면책 조항: 이 저장소의 코드는 교육 및 연구 목적으로만 제공됩니다. 소유하지 않거나 테스트할 명시적 권한이 없는 시스템에서 이 코드를 사용하지 마십시오. 이 코드의 부적절한 사용은 현지, 국가 또는 국제 법률을 위반할 수 있습니다. CVE-2023-52271 POC C++로 작성된 CVE-2023-52271 익스플로잇입니다. 이 코드는 취약한 드라이버 wsftprm.sys 커널 드라이버 2.0.0.0을 악용하여, 커널 수준의 액세스로 실행 중인 PPL 프로세스를 종료할 수 있습니다. 주로 AV/EDR 프로세스를 종료하는 데...

cve-2026-0828

CVE-2026-0828 — Safetica ProcessMonitorDriver.sys BYOVD PoC Safetica DLP カーネルドライバー ProcessMonitorDriver.sys は、認証されていない IOCTL を公開しており、任意のユーザーモード呼び出し元がカーネルコンテキスト内で ZwTerminateProcess を介して任意のプロセスを終了させ、PPL（Protected Process Light）保護をバイパスすることを可能にします。 CVSS: 8.8 High · Type: BYOVD, LPE · Platform: Windo...

RIPPL

RIPPL ドライバを使用せずにPPL保護プロセスを操作する このツールは、WindowsのPPL保護プロセスを操作するためのユーザーランドエクスプロイトを実装しています。この手法は、James Forshaw（別名@tiraniddo）とClément Labro（別名@itm4n）によって、以下のブログ記事で最初に議論されました。 James Forshaw氏のブログ記事 : Windows Exploitation Tricks Clément Labro氏のブログ記事 その1 : Do You Really Know About LSA Protection RunAsPPL?...

breakcyserver

breakcyserver 完全な投稿はこちら: https://waawaa.github.io/ 1. EDRプロセスの開かれたすべてのハンドルを閉じることで、EDRサービスを強制終了します。 2. Process Explorerドライバの一部の機能を悪用することでPPLをバイパスします。 3. Process Explorerドライバの機能を悪用することで、ObRegisterCallbacksの実装をバイパスします。 追記: ProcessExplorerなしでドライバを手動でロードする実装を追加しました。 LoadDriver.exe /LOAD...

CVE-2026-15430 CVE-2026-15430

Improper access control in the IRPMJWRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected lsass.exe, and terminate PPL-protected...

August 13, 2024—KB5041160 (OS Build 20348.2655)

None None...

August 13, 2024—KB5041592 (OS Build 22000.3147)

None None...

NativeDump - Dump Lsass Using Only Native APIs By Hand-Crafting Minidump Files (Without MinidumpWriteDump!)

NativeDump allows to dump the lsass process using only NTAPIs generating a Minidump file with only the streams needed to be parsed by tools like Mimikatz or Pypykatz SystemInfo, ModuleList and Memory64List Streams. NTOpenProcessToken and NtAdjustPrivilegeToken to get the "SeDebugPrivilege"...

CVE-2023-31096

An issue was discovered in Broadcom LSI PCI-SV92EX Soft Modem Kernel Driver through 2.2.100.1 aka AGRSM64.sys. There is Local Privilege Escalation to SYSTEM via a Stack Overflow in RTLCopyMemory IOCTL 0x1b2150. An attacker can exploit this to elevate privileges from a medium-integrity process to...

Privilege escalation

Privilege escalation vulnerability in the Self-Defense driver of Avast Antivirus prior to 20.8 allows a local user with SYSTEM privileges to gain elevated privileges by "hollowing" process wscproxy.exe which could lead to acquire antimalware AM-PPL protection...

CVE-2021-45337

CVE-2021-45337 describes a local privilege escalation in Avast Antivirus via the Self‑Defense driver. Before version 20.8, a local user with SYSTEM privileges could hollow out the process wsc_proxy.exe to gain elevated privileges, potentially enabling full antimalware (AM‑PPL) protection. Affecte...

TiEtwAgent - PoC Memory Injection Detection Agent Based On ETW, For Offensive And Defensive Research Purposes

This project was created to research, build and test different memory injection detection use cases and bypass techniques. The agent utilizes Microsoft-Windows-Threat-Intelligence event tracing provider, as a more modern and stable alternative to Userland-hooking, with the benefit of Kernel-mode...

The core of Apple is PPL: Breaking the XNU kernel's kernel

Posted by Brandon Azad, Project Zero While doing research for the one-byte exploit technique, I considered several ways it might be possible to bypass Apple's Page Protection Layer PPL using just a physical address mapping primitive, that is, before obtaining kernel read/write or defeating PAC...

CVE-2019-17093

An issue was discovered in Avast antivirus before 19.8 and AVG antivirus before 19.8. A DLL Preloading vulnerability allows an attacker to implant %WINDIR%\system32\wbemcomn.dll, which is loaded into a protected-light process PPL and might bypass some of the self-defense mechanisms. This affects...

Injecting Code into Windows Protected Processes using COM - Part 2

Posted by James Forshaw, Project Zero In my previous blog I discussed a technique which combined numerous issues I’ve previously reported to Microsoft to inject arbitrary code into a PPL-WindowsTCB process. The techniques presented don’t work for exploiting the older, stronger Protected Processes...

Microsoft Windows - CiSetFileCache WDAC Security Feature Bypass TOCTOU

Microsoft Windows - CiSetFileCache WDAC Security Feature Bypass TOCTOU Windows: CiSetFileCache TOCTOU CVE-2017-11830 Variant WDAC Security Feature Bypass Platform: Windows 10 1803, 1709 should include S-Mode but not tested Class: Security Feature Bypass Summary: While the TOCTOU attack against...

Microsoft Windows - 'CiSetFileCache' WDAC Security Feature Bypass TOCTOU

Windows: CiSetFileCache TOCTOU CVE-2017-11830 Variant WDAC Security Feature Bypass Platform: Windows 10 1803, 1709 should include S-Mode but not tested Class: Security Feature Bypass Summary: While the TOCTOU attack against cache signing has been mitigated through NtSetCachedSigningLevel it’s...

Microsoft Windows 10 - CiSetFileCache TOCTOU Security Feature Bypass Vulnerability

Exploit for windows platform in category local exploits Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1332 Windows: CiSetFileCache TOCTOU Security Feature Bypass Platform: Windows 10 10586/14393/10S not tested 8.1 Update 2 or Windows 7 Class: Security Feature Bypass Summary:...

Microsoft Windows 10 - CiSetFileCache TOCTOU Security Feature Bypass

Microsoft Windows 10 - CiSetFileCache TOCTOU Security Feature Bypass Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1332 Windows: CiSetFileCache TOCTOU Security Feature Bypass Platform: Windows 10 10586/14393/10S not tested 8.1 Update 2 or Windows 7 Class: Security Feature Bypa...