Advanced Search
Search Results
43 total results found
PowerISO 9.3.0.0 Kernel Driver 6.9.0.0 Local Privilege Escalation via Arbitrary Registry Write or Deletion
Summary PowerISO 9.3 installs the signed kernel driver scdemu.sys. When loaded, the driver creates user-visible virtual CD device links such as \\.\SCDEmuDev0. Two registry helper IOCTLs are reachable from a standard user: 0x80002018: writes or deletes a c...
Ultra RAMDisk Pro 1.82 Kernel Driver URDSCSI.sys Local Privilege Escalation via Arbitrary Registry Value Write
Summary Ultra RAMDisk Pro installs a WHQL-signed kernel driver, URDSCSI.sys, that exposes a user-reachable control device at \\.\UltraRAMDiskIOCTL. A standard local user can send IOCTL 0x222B30 with command 0x08 to make the driver call RtlCreateRegistryKey an...
StableBit Scanner 2.6.13.4088 Local Privilege Escalation via Insecure Deserialization
Summary StableBit Scanner exposes a local .NET Remoting IPC endpoint from ScannerService, which runs as LocalSystem. A standard local user can connect to \\.\pipe\Scanner2_Comm, perform a benign remoting call, and send a BinaryFormatter gadget as the object T...
StableBit DrivePool 2.3.13.1687 Local Privilege Escalation via Insecure Deserialization
Summary StableBit DrivePool exposes a local .NET Remoting IPC endpoint from DrivePoolService, which runs as LocalSystem. A standard local user can connect to \\.\pipe\StableBitDrivePool_Comm, perform a benign remoting call, and send a BinaryFormatter gadget a...
DeepCool 1.2.12 DisplayService Exposes an Unauthenticated LocalSystem Named-Pipe Control Channel
Summary DeepCool Deep Creative 1.2.12 installs DeepCoolDisplayService.exe, a service component intended to run as LocalSystem. In a live validation, a standard local user at Medium Integrity could not control the service through the Windows Service Control Ma...
Hey, You Hacked a Hacker! Are You Ready For My Revenge?
As an offensive security professional, I naturally focus on offensive techniques, and most of my previous writing has covered red teaming, security research, and other offensive-security topics. This article is therefore unusual for me: this time, I was not th...
你敢入侵我电脑？看我扒光你老底
// English version: https://winslow1984.com/books/threat-intelligence/page/hey-you-hacked-a-hacker-are-you-ready-for-my-revenge 作为一名进攻性安全从业者，我自然更关注攻击技术，自然过去写的大多数文章也都围绕红队、安全研究和其他进攻性安全话题展开。而这篇文章对我来说有些特别：这一次，我不是发起攻击的人，我是受害者。 不得不承认，因为执行了一段恶意脚本，导致自己的个人电脑被攻陷，多少还是有点...