Exploit Development393 Part 2 of NCC Group's CVE-2018-8611 series by Aaron Adams: a full walk-through of the Kernel Transaction Manager patch, including how to…
Exploit Development451 CVE-2018-8611 is a race-condition LPE in the Windows Kernel Transaction Manager (KTM), originally caught in the wild by Kaspersky’s AEP in October…
Exploit Development499 CVE-2024-1065 is a physical-page use-after-free in the ARM Mali GPU kernel driver. Because the freed page lands in MIGRATE_MOVABLE, Dirty Pagetable and…
Active Directory632 A walkthrough of a classic-but-still-effective Active Directory attack: how write access to an SMB share — plus a single .lnk file —…
buffer overflow441 When a Windows stack overflow gives you ~250 bytes of crash-buffer space but a useful Meterpreter payload is 400+ bytes, the answer…
Exploit Development453 CVE-2021-1732 is a Win32k local privilege escalation in win32kfull.sys. By flipping the 0x800 bit on tagWND with NtUserConsoleControl and returning a fake…
BitLocker640 GreatXML is a one-file BitLocker bypass against Windows 11 24H2. Drop an attacker-controlled unattend.xml and ReAgent.xml into the root of the recovery…
kernel704 A defender-side surface map of Windows kernel/user-mode covert channels — mailslots and ALPC, firmware-table providers and WNF, dispatch tables and writable .data…
kernel371 Walk-through of Lukas Maar’s page-level use-after-free in the Linux kernel’s QAIC (Qualcomm AI Accelerator) DRM driver: the missing VMA boundary check in…
Red Team Operations385 Walk-through of Xyrem's reversing.info analysis of Valorant’s Vanguard Guarded Regions: how Vanguard hides game state behind a private "shadow" PML4 entry that’s…
Red Team Operations274 Walk-through of Jack Halon's "Utilizing Syscalls in C# — Part 2" post: building a direct-syscall NtCreateFile PoC in C# .NET 3.5, extracting…
Kerberos277 Huntress reveals an unpatched Windows search: URI handler flaw that can leak Net-NTLMv2 hashes with a single link click. The bug mirrors…
