ALPC491 CVE-2020-1027 is a heap buffer overflow in the Windows CSRSS SxS assembly component. A missing bounds check on UNICODE_STRING.MaximumLength in an ALPC…
Debug544 This post tackles CFG and CET/Shadow Stack bypasses for sleep obfuscation. It registers ROP gadgets via NtSetInformationVirtualMemory, swaps TIB stack bounds instead…
RPC430 Many Windows RPC servers expose several context-handle types under one interface. When the IDL marks a handle as FC_BIND_CONTEXT (0x70) instead of…
Security448 Squidbleed (CVE-2026-47729) is a heap buffer over-read in the Squid proxy's FTP gateway, rooted in a missing NUL-terminator check before strchr() that…
Credential Attacks431 Windows Sandbox is supposed to be the safe place to open untrusted files — but the .wsb configuration file is parsed by…
Blue team503 Distributed COM (DCOM) lets one Windows host instantiate and drive COM objects on another over the network — and that same capability…
EDR Evasion658 Mohamed Alzhrani's LACUNA Chain combines BYOUD-Gap, the ETW-Ti APC window, win32u's 1,242 NOP gaps, ntdll/kernelbase ghost functions, BYOUD-MF machine-frame RSP teleport, BYOUD-RT…
kernel452 A deep technical walkthrough of how Windows on ARM (WoA) discovers, initializes and dispatches interrupts through the Generic Interrupt Controller (GIC) —…
Exploit Development398 A full-pipeline walkthrough: build a vulnerable Windows console program, take RIP with a strcpy overflow, then use rop_scanner — an offline ROP…
Active Directory364 Decoy accounts in Active Directory look legitimate at the schema level but cannot fake behavioural history. This walkthrough shows how to read…
Exploit Development490 CVE-2026-40369 is an unprivileged arbitrary 12-byte kernel write in nt!ExpGetProcessInformation, reachable from Chrome/Edge/Firefox renderer sandboxes via NtQuerySystemInformation. A walk through the unchecked…
Exploit Development551 A SYSTEM shell is the top of the user-mode pile, but it is not the kernel. This walkthrough of Windows HVCI in…
