Active Directory114 Domain Credential Dumping via File Handle Redirection
S12 points a notepad.exe File handle at ntds.dit, SYSTEM, and SECURITY on a live DC via BYOVD LowQword patch. No LSASS, no…
oxfemale·
Sep 14·
15 min
·114
// kernel
50 postsActive Directory114 
kernel172 Process ID Mutation via BYOVD: Making Sysmon Blame Notepad
Patch EPROCESS.UniqueProcessId and every ETHREAD.Cid with a GIO kernel write, and Sysmon attributes file, DNS and child-process events to Notepad. PspCidTable still…
oxfemale·
Sep 11·
29 min
·172
kernel296 From Job Offer to Ring 0: Lazarus, CVE-2026-68820 and FudModule 3.1
Lazarus spent a Windows kernel zero-day in afd.sys on a fake recruiter PDF. CVE-2026-68820 is a local UAF that skips BYOVD controls;…
oxfemale·
Sep 11·
28 min
·296
Exploit Development272 KERAT: Static Detection of Kernel TOCTOU Bugs Caused by Races
USENIX Security 2026: KERAT mines atomicity rules for check-use pairs on Linux and FreeBSD shared fields, then FSM-walks LLVM IR. 351 real…
oxfemale·
Sep 10·
34 min
·272
iOS Security186 How Can You Not Be Romantic About UNIX Domain Sockets: A 40-Year Kernel Bug From the DEF CON Stage
Yuval Hanoch Hirschenbein Sadde traced a DEF CON 34 demo crash to one character in XNU: unp_ino++ assigns inode 0 to the…
oxfemale·
Sep 9·
18 min
·186
BYOVD437 Physical Memory Is a Universal Kernel Primitive: The eneio64.sys LPE Chain on Windows 11 24H2
CVE-2020-12446 in eneio64.sys does not corrupt anything. Its MAPPHYSTOLIN handler opens \Device\PhysicalMemory and maps the entire physical address space, read/write, into whichever…
oxfemale·
Aug 18·
33 min
·437
buffer overflow395 Exploiting a Windows 10 PagedPool Off-by-One Overflow (WCTF 2018)
A single byte written past the end of a PagedPool allocation in a Windows 10 x64 kernel driver, followed all the way…
oxfemale·
Aug 13·
23 min
·395
Exploit Development427 CVE-2026-58629: A Double-Free in dxgkrnl’s CreateAllocation Rollback
CVE-2026-58629 is a double-fetch bug in the Windows graphics kernel (dxgkrnl). When D3DKMTCreateAllocation rolls back a failed create, it re-reads a user-controlled…
oxfemale·
Jul 21·
14 min
·427
buffer overflow393 CVE-2026-47291: Integer Overflow Remote Code Execution in Windows HTTP.sys
CVE-2026-47291 is a critical unauthenticated RCE vulnerability in Windows HTTP.sys caused by a 16-bit integer overflow in the buffer reference array growth…
oxfemale·
Jul 10·
11 min
·393
Exploit Development313 IDT Table Hijacking under VBS/HVCI/kCET in Windows 11
A data-only technique that hijacks the x64 Interrupt Descriptor Table (IDT) to achieve kernel code execution on a fully hardened Windows 11…
oxfemale·
Jun 30·
10 min
·313
Containers276 IPv6 Fragment Dirty-Pagetable: Reliable Container Escape on CentOS/RHEL 10
A deep technical walkthrough of ipv6_frag_escape, a public proof-of-concept exploit that converts a Linux kernel IPv6 fragmentation linear overflow into a reliable…
oxfemale·
Jun 29·
14 min
·276
kernel282 Windows ARM64 Internals: Pardon The Interruption — Interrupts on Windows for ARM
A deep technical walkthrough of how Windows on ARM (WoA) discovers, initializes and dispatches interrupts through the Generic Interrupt Controller (GIC) —…
oxfemale·
Jun 20·
55 min
·282