WinInt Compilation
Elementary: Understanding Processes
In this blog we will cover how windows process works, their structure and how we can pivot to nt-authority system or any user through WinDbg. No exploitation here, it is only to get acquainted in the environment for future exploits!
Arbritrary Write - HEVD (ft. Astharot15)
Learn how to exploit an arbritrary write throught a vulnerable driver to change token process and process protections. Windows 10 token hijacking & Windows 11 lsass dump
Taking Back Control - Windows File Ownership
A deep dive into Widnows file ownership, the NT Security Reference Monitor (*SRM*), and how to programmatically reclaim access to system protected files in System32 from kernel internals to working C code.
Use-After-Free - HEVD (+ SMEP/KASLR/KPP Bypass)
Diving into Use-After-Free explotation in the famous HackSys Extreme Vulnerable Driver (HEVD) to gain access to execute a gadget in order to escalate the attack vector to a shellcode, ROP chain...
StackOverflow GS x64
Understanding stack functionality, exploiting ArbitraryRead for leaking RSP value and address. This blog doesnt not finish in any LPE nor SMEP bypass.