benheise / ANGRYORCHARD
A kernel exploit leveraging NtUserHardErrorControl to elevate a thread to KernelMode and achieve arbitrary kernel R/W & more.
☆26Updated 2 years ago
Alternatives and similar repositories for ANGRYORCHARD:
Users that are interested in ANGRYORCHARD are comparing it to the libraries listed below
- Demonstrate calling a kernel function and handle process creation callback against HVCI☆52Updated 2 years ago
- Finding Truth in the Shadows☆88Updated 2 years ago
- arbitrary kernel read/write in dbutil_2_3.sys, Proof of Concept Local Privilege Escalation to nt authority/system☆54Updated 3 years ago
- Report and exploit of CVE-2024-21305.☆34Updated last year
- ☆12Updated 2 years ago
- Enabled / Disable LSA Protection via BYOVD☆65Updated 3 years ago
- PoC exploit for HP Hardware Diagnostic's EtdSupp driver☆50Updated last year
- WinHvShellcodeEmulator (WHSE) is a shellcode emulator leveraging the Windows Hypervisor Platform API☆22Updated 2 years ago
- A native Windows library for intercepting kernel-to-user transitions using instrumentation callbacks☆17Updated last year
- A VMWare logger using built-in backdoor.☆27Updated 4 months ago
- Enumerate Callbacks and all Object Types☆13Updated 2 years ago
- ☆106Updated 2 years ago
- Command like tool to print mitigation flags for running processes in a memory dump☆46Updated 4 years ago
- Monitors ETW for security relevant syscalls maintaining the set called by each unique process☆72Updated last year
- ☆26Updated 3 years ago
- ☆25Updated 2 years ago
- Example of building an application verifer DLL☆44Updated 8 months ago
- call gates as stable comunication channel for NT x86 and Linux x86_64☆31Updated last year
- ☆58Updated 2 years ago
- Implementation of an export address table protection mitigation, like Export Address Filtering (EAF)☆96Updated last year
- Next gen process injection technique☆44Updated 4 years ago
- Hook all callbacks which are registered with LdrRegisterDllNotification☆84Updated 2 years ago
- Former Multi - Ring to Kernel To UserMode Transitional Shellcode For Remote Kernel Exploits☆27Updated 2 years ago
- HEVD Exploit: ArbitraryWrite on Windows 10 22H2 - Bypassing KVA Shadow and SMEP via PML4 Entry Manipulation☆22Updated 7 months ago
- A few examples of how to trap virtual memory access on Windows.☆27Updated 2 months ago
- silence file system monitoring components by hooking their minifilters☆54Updated last year
- ☆18Updated 3 years ago
- A Practical example of ELAM (Early Launch Anti-Malware)☆32Updated 3 years ago
- UEFI bootkit: Hardware Implant. In-Progress☆13Updated 2 years ago
- Repository of Microsoft Driver Block Lists based off of OS-builds☆39Updated 10 months ago