ret-sync

ret-sync ret-sync stands for Reverse-Engineering Tools SYNChronization. It is a set of plugins that help to synchronize a debugging session WinDbg/GDB/LLDB/OllyDbg/OllyDbg2/x64dbg with a disassembler IDA/Ghidra/Binary Ninja. The underlying idea is simple: take the best from both worlds static and...

CVE-2025-54110-Kernel-EoP-PoC

CVE-2025-54110-Kernel-EoP-PoC PoC implementation for CVE-2025-54110 a Kernel-Level Integer Overflow Vulnerability in the Windows NtQueryDirectoryObject system call. CVE-2025-54110 - Windows Kernel Integer Overflow Analysis CVE: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54110...

nmap-CVE-2022-21907

nmap-CVE-2022-21907 Repository containing nse script for vulnerability CVE-2022-21907. It is a component IIS vulnerability on Windows. It allows remote code execution. The vulnerability affects the kernel module http.sys, which handles most basic IIS operations. After uploading the payload, the...

EtwLeakKernel

EtwLeakKernel This repository contains a PoC for a program that utilizes ETW to leak kernel memory addresses. It does so by creating a consumer could be to almost any provider as almost all of them leak kernel addresses and requesting a stack trace from it. Once the stack trace is received, it is...

CVE-2025-62215_Windows_Kernel_PE

CVE-2025-62215 Exploit PoC Original code credit: https://github.com/dexterm300 🧨 Description This repository contains a proof-of-concept exploit for CVE-2025-62215 , a race condition vulnerability in the Windows kernel that can be triggered via concurrent manipulation of kernel object handles...

CVE-2024-55511

CVE-2024-55511 This repository has been archived and moved here A null pointer dereference vulnerability in Macrium Reflect prior to 8.1.8017 allows a local attacker to cause a system crash or potentially elevate their privileges via executing a specially crafted executable. I am currently creati...

fibratus

Fibratus Security sensor for realtime threat detection and protection Get Started » Docs • Rules • Filaments • Download • Discussions Fibratus detects and eradicates advanced attacker tradecraft, malware, and emerging threats by scrutinizing and asserting a wide spectrum of system events against ...

CVE-2021-31728

CVE-2021-31727 and CVE-2021-31728 Public Reference for CVE-2021-31727 Exposes unrestricted disk read/write capabilities. Public Reference for CVE-2021-31728 Exposes arbitrary ring 0 code execution directly. Credit Lima X helped with SystemBigPoolInformation idea...

TopazTerminator

TopazTerminator F, Another driver got burned.. I was gatekeeping wsftprm.sys driver for a while ; but since someone posted a public POC, I'm ungatekeeping it. We all know it'll get added to the driver blocklist soon, so here's my implementation for the same — in C This project exploits the...

CVE-2022-21882

CVE-2022-21882 Win32k Elevation Of Privileges Techniques inspired from: https://github.com/L4ys/CVE-2022-21882 https://github.com/exploitblizzard/Windows-Privilege-Escalation-CVE-2021-1732...

CVE-2024-30088

CVE-2024-30088 Bug: Bug is inside function AuthzBasepCopyoutInternalSecurityAttributes when kernel copies the AUTHZBASEPSECURITYATTRIBUTESINFORMATION of current token object to user mode, which has structure like this: //0x30 bytes sizeof struct AUTHZBASEPSECURITYATTRIBUTESINFORMATION ULONG...

AutoPiff

AutoPiff Automated Patch Intelligence and Finding Framework A semantic analysis engine for detecting vulnerability fixes in Windows kernel driver patches. AutoPiff uses conservative YAML rules to identify security-relevant code changes with high precision and explainability. Overview AutoPiff...

CVE-2020-15368-AsrDrv103-research

CVE-2020-15368 — AsrDrv103.sys このリポジトリには、CVE-2020-15368 に関連する ASRock の AsrDrv103.sys Windows カーネルドライバのリバースエンジニアリングに関する資料が含まれています。 このプロジェクトは、Windows カーネルドライバ、ドライバ通信インターフェース、低レベルハードウェアアクセス、および脆弱なドライバ設計の実践的な研究として作成されました。 私は CVE-2020-15368 の最初の発見者ではありません。このリポジトリの目的は、ドライバに関する私自身の分析と理解を文書化することです。...

CVE-2026-42980-POC

CVE-2026-42980 공개 공개 이 저장소는 CVE-2026-42980 에 대한 공개 공개 자료를 포함하고 있습니다. 이는 취약한 실험실 빌드에서 NT AUTHORITY\SYSTEM으로의 로컬 권한 상승에 악용될 수 있는 Windows 커널 WMI 정수 언더플로 취약점입니다. 전체 글 영문 기사 스페인어 기사 저장소 구조 public/ README.md README.es.md writeup-en.md writeup-es.md build.ps1 Makefile src/ cve202642980lpe.c helpers.c...

CVE-2022-37969PoC

목차 일반 소개 이 문서는 Windows 익스플로잇과 관련된 일반적인 사항을 명확히 하기 위해 작성되었습니다. CVE-2022-37969에 적용된 기본 개념을 설명합니다. 최종 결과물은 동작하는 PoC입니다. CVE의 모든 측면을 설명하지는 않지만, 재사용 가능한 코드 조각을 제공하고 많은 일반 익스플로잇에서 찾을 수 있는 메커니즘을 설명합니다. 대상 독자는 기초 리버스 엔지니어, 동작하는 개념 증명 소스 코드를 테스트하고 기본 Windows Internals를 이해하려는 익스플로잇 개발자입니다. 더 깊이 배우기 위한 참조점을...

CVE-2019-0708-poc

CVE-2019-0708 Big shout out to the Dox King Krebs and also the thief of inventions and all-purpose fraud, Kevin. https://www.youtube.com/watch?v=dQw4w9WgXcQ...

CVE-2025-62215-POC

CVE-2025-62215 — Windows Token UAF SepTokenSidSharingEnabled Race Condition This repository is for educational and research purposes only. Overview A Use-After-Free vulnerability PoC that occurs in the SepTokenSidSharingEnabled optimization path of the Windows kernel. When NtDuplicateToken...

drift-corpus

The Drift Corpus: Ring 0 Drift Corpus is the definitive, open-source repository of Windows Kernel patch diffs. These artifacts are produced using Drift Agent , ByteRay's automatic reverse engineering engine and part of the Argus-Systems platform. With Drift, we have successfully mapped, analyzed,...

CVE-2025-50168-pwn2own-berlin-2025

著者: D4m0n CVE-2025-50168 これは Pwn2Own Berlin 2025 - LPEカテゴリー に提出されたエクスプロイトです。 脆弱性は Win32kbase!DirectComposition に存在し、詳細はブログ記事で確認できます。 謝辞 kASLRバイパス技術: prefetch-tool（carrotc4k3 作） 特別な感謝: Out of Bounds の David 氏と Louis 氏 免責事項 このリポジトリは教育および研究目的のみに使用され、悪意のある目的で使用してはなりません。無許可または違法な活動へのマテリアルの使用は固く禁止されていま...

Windows-2

Windows-2 BlueKeep 취약점 실습 환경 - CVE-2019-0708 1. 개요 이 저장소는 원격 데스크톱 프로토콜RDP 서비스에 영향을 미치는 BlueKeep 취약점을 시연하기 위해 의도적으로 취약하게 구성된 Windows 실습 환경을 포함합니다. BlueKeep은 Windows 커널에 존재하는 중요한 인증 전 원격 코드 실행RCE 취약점입니다. 이 취약점으로 인해 인증되지 않은 공격자가 RDP 서비스를 통해 원격으로 메모리 손상을 유발하여 잠재적으로 전체 시스템 장악 또는 서비스 거부로 이어질 수 있습니다. 이...