Exploit Development75

Exploit Developmentkernel

CVE-2026-40369: Twelve Bytes to Escape the Browser Sandbox

CVE-2026-40369 is an unprivileged arbitrary 12-byte kernel write in nt!ExpGetProcessInformation, reachable from Chrome/Edge/Firefox renderer sandboxes via NtQuerySystemInformation. A walk through the unchecked…

oxfemale· Jun 16· 15 min ·75

Exploit Development54

Exploit DevelopmentSecurity

HVCI in 2026: How Far Down a SYSTEM Shell Actually Gets You

A SYSTEM shell is the top of the user-mode pile, but it is not the kernel. This walkthrough of Windows HVCI in…

oxfemale· Jun 16· 14 min ·54

Exploit Development54

Exploit DevelopmentSecurity

CVE-2018-8611 Part 2/5: Patch Analysis and Basic Triggering of the Windows KTM UAF

Part 2 of NCC Group's CVE-2018-8611 series by Aaron Adams: a full walk-through of the Kernel Transaction Manager patch, including how to…

oxfemale· Jun 16· 26 min ·54

Exploit Development56

Exploit Developmentkernel

CVE-2018-8611 — Exploiting the Windows Kernel Transaction Manager (Part 1/5: Introduction)

CVE-2018-8611 is a race-condition LPE in the Windows Kernel Transaction Manager (KTM), originally caught in the wild by Kaspersky’s AEP in October…

oxfemale· Jun 15· 11 min ·56

EDR Evasion52

EDR EvasionExploit Development

tabby — A Minimal Position-Independent Windows x64 Shellcode Framework, Built Entirely on Linux

cocomelonc’s tabby is a tiny teaching framework for writing position-independent Windows x64 shellcode in C, with indirect NT syscalls and no IAT,…

oxfemale· Jun 15· 23 min ·52

Exploit Development63

Exploit Developmentkernel

Exploiting CVE-2024-1065 via the Page Cache — A Physical-Page UAF in the ARM Mali GPU Driver

CVE-2024-1065 is a physical-page use-after-free in the ARM Mali GPU kernel driver. Because the freed page lands in MIGRATE_MOVABLE, Dirty Pagetable and…

oxfemale· Jun 13· 20 min ·63

buffer overflow35

buffer overflowExploit Development

Overcoming Space Restrictions with Egghunters in Windows Exploit Development — Savant Web Server 3.1, Syscall & SEH Egghunters, Heap Staging

When a Windows stack overflow gives you ~250 bytes of crash-buffer space but a useful Meterpreter payload is 400+ bytes, the answer…

oxfemale· Jun 12· 54 min ·35

Exploit Development51

Exploit Developmentkernel

Windows Win32k Elevation of Privilege Vulnerability (CVE-2021-1732): Walkthrough of the ConsoleControl Offset Confusion

CVE-2021-1732 is a Win32k local privilege escalation in win32kfull.sys. By flipping the 0x800 bit on tagWND with NtUserConsoleControl and returning a fake…

oxfemale· Jun 12· 14 min ·51

Exploit Development45

Exploit Development

Patching the Windows Kernel via BYOVD: ThrottleStop.sys, MmMapIoSpace and the NtAddAtom Trampoline

zer0matt's Milan0day 2026 talk walks through a clean BYOVD chain: ThrottleStop.sys (CVE-2025-7771) gives arbitrary physical-memory R/W via MmMapIoSpace, used to inline-patch NtAddAtom…

oxfemale· Jun 9· 13 min ·45

Exploit Development34

Exploit Development

OOBdump: Single-Shot Heap-OOB Exploitation of objdump -g via FR30 Relocations

A missing bounds check in binutils' FR30 relocation handler lets a single crafted object file turn objdump -g into a one-shot exploit…

oxfemale· Jun 9· 15 min ·34

Bypassing76

BypassingExploit Development

Eventvwr.exe UAC Bypass via mscfile: Anatomy of a Classic HKCU Registry Hijack

A walkthrough of the well-documented Windows UAC bypass that uses "eventvwr.exe"’s auto-elevate manifest plus a writable HKCU registry handler for the "mscfile"…

oxfemale· May 31· 14 min ·76

Exploit Development67

Exploit DevelopmentNetwork

Gogs Authenticated RCE via git rebase –exec Argument Injection (Unpatched)

Rapid7’s Jonah Burgess has disclosed a critical (CVSS 9.4) authenticated argument-injection RCE in the self-hosted Gogs Git server. Any authenticated user can…

oxfemale· May 30· 12 min ·67