HACKINGISCOOL

My latest research on driver vulnerability hardware-gating, diving deep into the technical details of hardware-dependent code and creative deployment techniques - software-emulated phantom devices, driver restacking, and forced driver replacement — all ex…

Anatomy of access: Windows device objects from a security perspective Shaping the future together Shaping the future together

Intro I want to touch on the very common problem of incomplete coverage of code paths inherent to blackbox and greybox security testing of web apps.

This article continues on the subject of using EDR telemetry to search for potential security vulnerabilities, the basics of which I have covered in the first part: https://hackingiscool.pl/using-edr-telemetry-for-offensive-research/.

This is just a short complementary follow-up after the previous, much longer article (https://hackingiscool.pl/breaking-out-from-stripped-tokens-using-process-injection/) about moving code execution to a process with a more privileged token (in terms of t…

Intro On the 15th of October 2024 Trendmicro has published an article titled “Red Team Tool EDRSilencer Disrupting Endpoint Security Solutions” (https://www.trendmicro.com/en_us/research/24/j/edrsilencer-disrupting-endpoint-security-solutions.html).

Intro In the beginning of my recent article -https://hackingiscool.pl/breaking-out-from-stripped-tokens-using-process-injection/- I mentioned that it laid out the groundwork for something I was about to publish soonish.

Introduction This is mostly dedicated to people working with vulnerabilities affecting commonly used software: vulnerability management teams, system administrators, red teams, incident responders, threat hunters, threat intelligence, bug hunters, security

Intro What I am going to showcase here isn't anything new, but it lays out the groundwork for what I am going to publish next, soon-ish.

This one is about a neat technique which is still not so well-known at the time of writing this.

GitHub - ewilded/ZScaler_msiexec_LPE_2023: My proof of concept for a Local Privilege Escalation via msiexec in ZScaler Client Connector 3.7.2.18 My proof of concept for a Local Privilege Escalation via msiexec in ZScaler Client Connector 3.7.2.18 - ewilde…

GitHub - ewilded/CVE-2024-35315-POC: Mitel Collab Local Privilege Escalation CVE-2024-35315 PoC Mitel Collab Local Privilege Escalation CVE-2024-35315 PoC - ewilded/CVE-2024-35315-POC GitHubewilded

Vulnerability summary: Local Privilege Escalation from regular user to SYSTEM, via conhost.exe hijacking triggered by MSI installer in repair mode Affected Products: Intel PowerGadget Affected Versions: tested on PowerGadget_3.6.msi (a3834b2559c18e6797ba9…

POC for the flaw in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows that allows an attacker to execute code at a SYSTEM level via local access. https://github.com/ewilded/CVE-2023-7016-POC

Proof of concept for Local Privilege Escalation in Thales Sentinel HASP LDK.