WinPmem

WinPmem -- 물리 메모리 수집 도구 WinPmem 은 오랫동안 Windows용 기본 오픈 소스 메모리 수집 드라이버였습니다. 원래 Rekall 프로젝트에 포함되어 있었지만, 최근에 자체 저장소로 분리되었습니다. 이것은 Windows 버전입니다. Linux 버전인 Linpmem 은 다음 위치에 있습니다: https://github.com/Velocidex/Linpmem 저작권 이 코드는 원래 Google 내에서 개발되었지만 Apache 라이선스 하에 배포되었습니다. 설명 WinPmem은 다음과 같은 기능을 갖춘 물리 메모...

physmem2profit

Physmem2profit Physmem2profit può essere utilizzato per creare un minidump del processo LSASS di un host target analizzando la memoria fisica da remoto. L'intento di questa ricerca è proporre un approccio alternativo al furto di credenziali e creare un framework modulare che possa essere esteso p...

EUVD-2024-33562

Malicious code in bioql PyPI...

EUVD-2024-51042

Malicious code in bioql PyPI...

CVE-2024-12668

Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability. By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the...

CVE-2024-10972

Velocidex WinPmem versions 4.1 and below suffer from an Improper Input Validation vulnerability whereby an attacker with admin access can trigger a BSOD with a parallel thread changing the memory’s access right under the control of the user-mode application. This is due to verification only being...

CVE-2024-12668 Velocidex WinPmem Out of Bounds Write Vulnerability

Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability. By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the...

CVE-2024-12668

Velocidex WinPmem

CVE-2024-12668 Velocidex WinPmem Out of Bounds Write Vulnerability

Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability. By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the...

CVE-2024-12668 Velocidex WinPmem Out of Bounds Write Vulnerability

Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability. By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the...

CVE-2024-10972 WinPmem Improper Input Validation vulnerability

Velocidex WinPmem versions 4.1 and below suffer from an Improper Input Validation vulnerability whereby an attacker with admin access can trigger a BSOD with a parallel thread changing the memory’s access right under the control of the user-mode application. This is due to verification only being...

CVE-2024-10972

Velocidex WinPmem (versions 4.1 and earlier) suffers from an Improper Input Validation vulnerability. The root cause is verification only at the start of a routine, enabling a userspace process with admin privileges to change memory page permissions mid-execution, potentially triggering a BSOD vi...

CVE-2024-10972 WinPmem Improper Input Validation vulnerability

Velocidex WinPmem versions 4.1 and below suffer from an Improper Input Validation vulnerability whereby an attacker with admin access can trigger a BSOD with a parallel thread changing the memory’s access right under the control of the user-mode application. This is due to verification only being...

CVE-2024-10972 WinPmem Improper Input Validation vulnerability

Velocidex WinPmem versions 4.1 and below suffer from an Improper Input Validation vulnerability whereby an attacker with admin access can trigger a BSOD with a parallel thread changing the memory’s access right under the control of the user-mode application. This is due to verification only being...

WinPmem 安全漏洞

WinPmem is an open source physical memory acquisition tool from Velocidex. A security vulnerability exists in WinPmem version 4.1 and earlier versions that stems from improper validation of input...

WinPmem 安全漏洞

WinPmem is an open source physical memory acquisition tool from Velocidex. A security vulnerability exists in WinPmem versions prior to 4.1, which stems from an information leak in the inPmem driver. An attacker can exploit the vulnerability to discover the location of the gCiOptions global symbo...

PT-2024-17709 · Velocidex · Velocidex Winpmem

Name of the Vulnerable Software and Affected Versions: Velocidex WinPmem versions below 4.1 Description: The issue allows a user space program to trick the driver into writing a 0 into any chosen memory location by using an IO Control. In conjunction with information leakage from the WinPmem...

CSIRT-Collect - PowerShell Script To Collect Memory And (Triage) Disk Forensics

A PowerShell script to collect memory and triage disk forensics for incident response investigations. The script leverages a network share, from which it will access and copy the required executables and subsequently upload the acquired evidence to the same share post-collection. Permission...

Gargamel - A Forensic Evidence Acquirer

A Forensic Evidence Acquirer Compile Assuming you have Rust 1.41+ installed. Open terminal in the project directory and to compile a release build type cargo build --release Debug build can be compiled using cargo build Compiled executable is located at target/release/gargamel.exe or...