ewilded's infosec note dumpster
My latest research on driver vulnerability hardware-gating, diving deep into the technical details of hardware-dependent code and creative deployment techniques - software-emulated phantom devices, driver restacking, and forced driver replacement — all explored through the lens of Bring Your Own Vulnerable Driver (BYOVD) attacks. https://atos.net/wp-content/uploads/2026/
Anatomy of access: Windows device objects from a security perspective Shaping the future together Shaping the future together
Intro I want to touch on the very common problem of incomplete coverage of code paths inherent to blackbox and greybox security testing of web apps. I have never been a fan of this approach to security testing, mostly due to the very limited target visibility leading to a disproportionately
This article continues on the subject of using EDR telemetry to search for potential security vulnerabilities, the basics of which I have covered in the first part: https://hackingiscool.pl/using-edr-telemetry-for-offensive-research/ .  In that part I mentioned that having base events carrying information on file (or any other securable object)
This is just a short complementary follow-up after the previous, much longer article ( https://hackingiscool.pl/breaking-out-from-stripped-tokens-using-process-injection /) about moving code execution to a process with a more privileged token (in terms of token privileges and/or group memberships). In addition to the main method (process injection) and the second method
Intro On the 15 th of October 2024 Trendmicro has published an article titled “Red Team Tool EDRSilencer Disrupting Endpoint Security Solutions” ( https://www.trendmicro.com/en_us/research/24/j/edrsilencer-disrupting-endpoint-security-solutions.html ). It describes a tool used by red teams and adversaries to disrupt EDR solutions by
Intro In the beginning of my recent article - https://hackingiscool.pl/breaking-out-from-stripped-tokens-using-process-injection/ - I mentioned that it laid out the groundwork for something I was about to publish soonish. This is it. The idea started roaming my mind back in 2019 when I began working as an incident responder.
Introduction This is mostly dedicated to people working with vulnerabilities affecting commonly used software: vulnerability management teams, system administrators, red teams, incident responders, threat hunters, threat intelligence, bug hunters, security researchers and software vendors. To some extent, this subject has been bugging me for years, so eventually I decided to
Intro What I am going to showcase here isn't anything new, but it lays out the groundwork for what I am going to publish next, soon-ish. This article will help you learn about: attacking Windows services running under dedicated service accounts (such as NETWORK SERVICE and LOCAL SERVICE)
This one is about a neat technique which is still not so well-known at the time of writing this. It was presented to me as a method for gaining initial access, and then quite quickly I realized it can also become handy for other scenarios; persistence, privilege escalation and denial
GitHub - ewilded/ZScaler_msiexec_LPE_2023: My proof of concept for a Local Privilege Escalation via msiexec in ZScaler Client Connector 3.7.2.18 My proof of concept for a Local Privilege Escalation via msiexec in ZScaler Client Connector 3.7.2.18 - ewilded/ZScaler_msiexec_LPE_
GitHub - ewilded/CVE-2024-35315-POC: Mitel Collab Local Privilege Escalation CVE-2024-35315 PoC Mitel Collab Local Privilege Escalation CVE-2024-35315 PoC - ewilded/CVE-2024-35315-POC GitHub ewilded
Vulnerability summary : Local Privilege Escalation from regular user to SYSTEM, via conhost.exe hijacking triggered by MSI installer in repair mode Affected Products : Intel PowerGadget Affected Versions : tested on PowerGadget_3.6.msi (a3834b2559c18e6797ba945d685bf174), file signed on ‎Monday, ‎February ‎1, ‎2021 9:43:20 PM (this
POC for the flaw in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows that allows an attacker to execute code at a SYSTEM level via local access. https://github.com/ewilded/CVE-2023-7016-POC
Proof of concept for Local Privilege Escalation in Thales Sentinel HASP LDK. GitHub - ewilded/CVE-2024-0197-POC: Proof of concept for Local Privilege Escalation in Thales Sentinel HASP LDK. Proof of concept for Local Privilege Escalation in Thales Sentinel HASP LDK. - ewilded/CVE-2024-0197-POC GitHub ewilded