BitLocker209 Multiple vulnerabilities in CPSD CryptoPro Secure Disk for BitLocker
SEC Consult found two high-impact vulnerabilities in CryptoPro Secure Disk for BitLocker (
oxfemale·
Feb 25·
4 min
·209
// windows
198 postsBitLocker209 
BitLocker215 Hacking a stolen laptop: bypassing Windows security (BitLocker etc.) using PCI connector.
The article outlines security researcher Pierre-Nicolas Allard-Coutu’s demonstration of attacking a stolen Windows laptop using a PCIe connector to bypass protections like…
oxfemale·
Feb 24·
1 min
·215
Debug258 Windows Kernel Debugging
The article explains how to set up Windows kernel debugging over a network using WinDBG and a host/target configuration. It covers enabling…
oxfemale·
Feb 23·
8 min
·258
Bypassing255 RPC Proxy Injection Part II: Breaking Elastic EDR Telemetry
The article explains enhancing RPC Proxy Injection to evade Elastic EDR telemetry by avoiding common API calls like WriteProcessMemory and CreateRemoteThread, using…
oxfemale·
Feb 23·
33 min
·255
Bypassing238 Living off the Process
The article “Living off the Process” details a technique to inject and execute shellcode into a remote Windows process by reusing existing…
oxfemale·
Feb 23·
30 min
·238
Antivirus225 EDR-Freeze: A Tool That Puts EDRs And Antivirus Into A Coma State
The article presents EDR-Freeze, a user-mode tool exploiting Windows Error Reporting to suspend EDR and antivirus processes by abusing MiniDumpWriteDump and WerFaultSecure,…
oxfemale·
Feb 23·
6 min
·225
ASR270 Bypassing Elastic EDR to Perform Lateral Movement
Article demonstrates how lateral movement can still be achieved in a lab with Elastic EDR and Microsoft ASR enabled by modifying payload…
oxfemale·
Feb 23·
4 min
·270
Active Directory291 EventLog-in: Propagating With Weak Credentials Using the Eventlog Service in Microsoft Windows (CVE-2025-29969)
SafeBreach Labs disclosed a critical RCE in the MS-EVEN RPC service (CVE-2025-29969) that lets low-privilege users write arbitrary files remotely on Windows…
oxfemale·
Feb 23·
19 min
·291
ALPC Uncovered: The Hidden Backbone of Local RPC in Windows 11 and Server 2025
This article explores ALPC in Windows 11 and Windows Server 2025, covering hardened server design, message attributes, section-based transfer, and its role…
oxfemale·
Feb 23·
17 min
·408
ALPC1.2k Analysis of Improper Authorization in Windows Error Reporting CVE-2026-20817 (PoC)
Proof-of-Concept (PoC) for CVE-2026-20817, a local privilege escalation vulnerability in the Windows Error Reporting (WER) service. The vulnerability allows an authenticated low-privileged…
oxfemale·
Feb 18·
13 min
·1.2k
access247 Looking into Windows Access Masks
Access masks are 32-bit permission values defining what operations a handle or security descriptor allows. The article breaks down standard, specific, and…
oxfemale·
Feb 18·
8 min
·247
Bypassing279 Trust Me, I’m a Shortcut
LNK shortcut abuse remains effective because shortcuts are trusted and rarely inspected. The technique enables stealthy execution and strong phishing scenarios. Its…
oxfemale·
Feb 16·
16 min
·279