evil-mhyprot-cli

evil-mhyprot-cli 针对 Mhyprot2.sys 易受攻击驱动程序的 PoC，允许非特权用户进程在内核/用户态中读写内存。 libmhyprot Wiki 概述 通过此 CLI，我们可以执行以下操作： 从用户态以内核权限读写任意内核内存 从用户态以内核权限读写任意用户内存 按指定进程 ID 枚举多个模块 获取系统运行时间 枚举指定进程中的线程，结果允许我们直接从 CLI 读取内核中的 PETHREAD 结构。 通过易受攻击驱动程序上下文（ring-0）中调用的 ZwTerminateProcess 按进程 ID 终止指定进程。 所有操作均以内核级权限（ring-0）通过易...

CVE-2024-36054

Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily read kernel memory and consequently gain all privileges via IOCTL 0x9c4064b8 via MmMapIoSpace and IOCTL 0x9c406490 via ZwMapViewOfSection...

CVE-2024-36055

Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily map physical memory with read/write access via the MmMapIoSpace API IOCTL 0x9c40a4f8, 0x9c40a4e8, 0x9c40a4c0, 0x9c40a4c4, 0x9c40a4ec, and seven others, leading to a denial of service BSOD...

CVE-2024-36056

The connected PT-2024-26869 entry provides concrete details for Marvin Test HW.exe prior to version 5.0.5.0, where Hw64.sys allows unprivileged user-mode processes to arbitrarily map physical memory via IOCTL 0x9c406490 (involving IoAllocateMdl, MmBuildMdlForNonPagedPool, and MmMapLockedPages). T...