Exploit Development551 HVCI in 2026: How Far Down a SYSTEM Shell Actually Gets You
A SYSTEM shell is the top of the user-mode pile, but it is not the kernel. This walkthrough of Windows HVCI in…
oxfemale·
Jun 16·
14 min
·551
// Exploit Development
98 postsExploit Development551 
Exploit Development393 CVE-2018-8611 Part 2/5: Patch Analysis and Basic Triggering of the Windows KTM UAF
Part 2 of NCC Group's CVE-2018-8611 series by Aaron Adams: a full walk-through of the Kernel Transaction Manager patch, including how to…
oxfemale·
Jun 16·
26 min
·393
Exploit Development450 CVE-2018-8611 — Exploiting the Windows Kernel Transaction Manager (Part 1/5: Introduction)
CVE-2018-8611 is a race-condition LPE in the Windows Kernel Transaction Manager (KTM), originally caught in the wild by Kaspersky’s AEP in October…
oxfemale·
Jun 15·
11 min
·450
EDR Evasion576 tabby — A Minimal Position-Independent Windows x64 Shellcode Framework, Built Entirely on Linux
cocomelonc’s tabby is a tiny teaching framework for writing position-independent Windows x64 shellcode in C, with indirect NT syscalls and no IAT,…
oxfemale·
Jun 15·
23 min
·576
Exploit Development499 Exploiting CVE-2024-1065 via the Page Cache — A Physical-Page UAF in the ARM Mali GPU Driver
CVE-2024-1065 is a physical-page use-after-free in the ARM Mali GPU kernel driver. Because the freed page lands in MIGRATE_MOVABLE, Dirty Pagetable and…
oxfemale·
Jun 13·
20 min
·499
buffer overflow441 Overcoming Space Restrictions with Egghunters in Windows Exploit Development — Savant Web Server 3.1, Syscall & SEH Egghunters, Heap Staging
When a Windows stack overflow gives you ~250 bytes of crash-buffer space but a useful Meterpreter payload is 400+ bytes, the answer…
oxfemale·
Jun 12·
54 min
·441
Exploit Development453 Windows Win32k Elevation of Privilege Vulnerability (CVE-2021-1732): Walkthrough of the ConsoleControl Offset Confusion
CVE-2021-1732 is a Win32k local privilege escalation in win32kfull.sys. By flipping the 0x800 bit on tagWND with NtUserConsoleControl and returning a fake…
oxfemale·
Jun 12·
14 min
·453
Exploit Development620 Patching the Windows Kernel via BYOVD: ThrottleStop.sys, MmMapIoSpace and the NtAddAtom Trampoline
zer0matt's Milan0day 2026 talk walks through a clean BYOVD chain: ThrottleStop.sys (CVE-2025-7771) gives arbitrary physical-memory R/W via MmMapIoSpace, used to inline-patch NtAddAtom…
oxfemale·
Jun 9·
13 min
·620
Exploit Development359 OOBdump: Single-Shot Heap-OOB Exploitation of objdump -g via FR30 Relocations
A missing bounds check in binutils' FR30 relocation handler lets a single crafted object file turn objdump -g into a one-shot exploit…
oxfemale·
Jun 9·
15 min
·359
Bypassing444 Eventvwr.exe UAC Bypass via mscfile: Anatomy of a Classic HKCU Registry Hijack
A walkthrough of the well-documented Windows UAC bypass that uses "eventvwr.exe"’s auto-elevate manifest plus a writable HKCU registry handler for the "mscfile"…
oxfemale·
May 31·
14 min
·444
Exploit Development521 Gogs Authenticated RCE via git rebase –exec Argument Injection (Unpatched)
Rapid7’s Jonah Burgess has disclosed a critical (CVSS 9.4) authenticated argument-injection RCE in the self-hosted Gogs Git server. Any authenticated user can…
oxfemale·
May 30·
12 min
·521
Exploit Development644 Writing Sync, Popping Cron: A Novel SQLite-Injection-to-Cron RCE on Synology BeeStation (CVE-2024-50629/50630/50631)
A deep technical write-up of the Synology BeeStation pre-auth-to-RCE chain disclosed by DEVCORE at Pwn2Own Ireland 2024 (CVE-2024-50629 CRLF injection, CVE-2024-50630 auth…
oxfemale·
May 30·
16 min
·644