PPLBlade

PPLBlade Herramienta de volcado de procesos protegidos que soporta la ofuscación del volcado de memoria y su transferencia a estaciones de trabajo remotas sin guardarlo en el disco. Funcionalidades clave : 1. Evitar la protección PPL 2. Ofuscar archivos de volcado de memoria para evadir los...

KSLDBYOVDARK

KSLDBYOVD Referencia: KslKatz y KslDump. KslD.sys, también conocido como MpKslDrv.sys, solía ser uno de los controladores de herramientas anti-rootkit de Microsoft Antimalware que incluye Microsoft Defender Antivirus, Windows Defender Antivirus en versiones antiguas de Windows, Microsoft Security...

PPLdump

PPLdump ⚠️ 2022-07-24 - 自 Windows 10 21H2 10.0.19044.1826 （2022年7月更新）起，PPLdump 中实现的利用方法已不再有效。NTDLL 中的一个补丁现在阻止 PPL 加载 已知 DLL 。更多信息请参见此处。 本工具实现了一个 用户态 漏洞利用，最初由 James Forshaw（即 @tiraniddo）在这篇博文中讨论，用于以管理员身份 转储任意 PPL 的内存 。 我撰写了两篇关于此工具的博文。第一部分介绍受保护进程的概念，第二部分讨论绕过技术本身。 博文第一部分 ：你真的了解 LSA 保护 RunAsPPL 吗？...

CVE-2026-0293

Prisma Access Agent for Windows is affected by CVE-2026-0293, which enables a local attacker with administrator privileges to bypass anti-tamper protection and gain unauthorized access to protected processes and files. The vulnerability does not affect Prisma Access Agent on Linux, macOS, iOS, An...

CVE-2026-57851

MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory read/write and unrestricted I/O port operations by accessing exposed IOCTL handlers without administrator...

CVE-2026-57851

MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory read/write and unrestricted I/O port operations by accessing exposed IOCTL handlers without administrator...

CVE-2026-57851

MSI Feature Manager contains a local privilege escalation via the KernCoreLib64.sys kernel driver. An attacker with local access can use exposed IOCTL handlers to perform arbitrary physical memory read/write and unrestricted I/O port operations without administrator privileges. This can enable ma...

CVE-2026-57851 MSI KernCoreLib64.sys Privilege Escalation via IOCTL Handlers

MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory read/write and unrestricted I/O port operations by accessing exposed IOCTL handlers without administrator...

CVE-2026-57851 MSI KernCoreLib64.sys Privilege Escalation via IOCTL Handlers

MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory read/write and unrestricted I/O port operations by accessing exposed IOCTL handlers without administrator...

EUVD-2026-42053

MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory read/write and unrestricted I/O port operations by accessing exposed IOCTL handlers without administrator...

VulnCheck KEV: CVE-2023-52271

The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any Protected Process Light process via an IOCTL which will be named at a later time...

CVE-2023-52271

The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any Protected Process Light process via an IOCTL which will be named at a later time...

CVE-2023-52271

The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any Protected Process Light process via an IOCTL which will be named at a later time...

PPLBlade - Protected Process Dumper Tool

Protected Process Dumper Tool that support obfuscating memory dump and transferring it on remote workstations without dropping it onto the disk. Key functionalities : 1. Bypassing PPL protection 2. Obfuscating memory dump files to evade Defender signature-based detection mechanisms 3. Uploading...

SUSE CVE-2015-0001

The Windows Error Reporting WER component in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass the Protected Process Light protection mechanism and read the contents of arbitrary process-memory locations by leveraging...

PPLdump - Dump The Memory Of A PPL With A Userland Exploit

This tool implements a userland exploit that was initially discussed by James Forshaw a.k.a. @tiraniddo - in this blog post - for dumping the memory of any PPL as an administrator. I wrote two blog posts about this tool. The first part is about Protected Processes concepts while the second one...

CVE-2019-17093

An issue was discovered in Avast antivirus before 19.8 and AVG antivirus before 19.8. A DLL Preloading vulnerability allows an attacker to implant %WINDIR%\system32\wbemcomn.dll, which is loaded into a protected-light process PPL and might bypass some of the self-defense mechanisms. This affects...

Injecting Code into Windows Protected Processes using COM - Part 1

Posted by James Forshaw, Google Project Zero At Recon Montreal 2018 I presented “Unknown Known DLLs and other Code Integrity Trust Violations” with Alex Ionescu. We described the implementation of Microsoft Windows’ Code Integrity mechanisms and how Microsoft implemented Protected Processes PP. A...

Microsoft Windows Error Reporting Security Mechanism Bypass Vulnerability

Microsoft Windows is a family of operating systems from Microsoft. A security bypass vulnerability exists in Microsoft Windows Error Reporting WER that could allow an administrative user to view the contents of process memory protected by "Protected Process Light.", resulting in the disclosure of...

CVE-2015-0001

The Windows Error Reporting WER component in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass the Protected Process Light protection mechanism and read the contents of arbitrary process-memory locations by leveraging...