Folder Path

/vx/Papers/Windows/System Components and Abuse/

0 directories 69 files
List Grid
Name
Size Modified
Up
2016-11-21 - Keylogging using ETW in CSharp.NET.7z
3.3 MiB
2017-08-12 - Finding handle leaks - user mode duplicate handle in C and CSharp.zip
47 KiB
2018-03-17 - Abusing Exported Functions and Exposed DCOM Interfaces.pdf
890 KiB
2019-04-07 - Loading and calling VB from CPlusPlus.zip
5.3 KiB
2019-07-03 - Dumping LSASS - MiniDumpWriteDump to Disk.txt
1.2 KiB
2019-07-03 - MiniDumpWriteDump and PssCaptureSnapshot.txt
2.3 KiB
2019-07-07 - Dumping LSASS - MiniDumpWriteDump to Memory using MiniDump Callbacks.txt
3.4 KiB
2019-07-21 - In-memory execution of VBScript, JavaScript or JScript.txt
7.2 KiB
2019-08-17 - Weaponizing Privileged File Writes with the USO Service.7z
1.1 MiB
2020-01-23 - Starting WERSVR from a restricted users.7z
491 KiB
2020-04-30 - Fax Shell - Using Fax service for system.7z
13 KiB
2020-06-10 - Cmd Hijack - A Command_Argument Confustion with Path Traversal.pdf
2.2 MiB
2020-10-10 - A Deep Dive Into RUNDLL32EXE.pdf
279 KiB
2021-01-24 - LSASS Memory Dumps are Stealthier than Ever Before - Part 1.pdf
477 KiB
2021-02-16 - LSASS Memory Dumps are Stealthier than Ever Before - Part 2.pdf
268 KiB
2021-05-13 - Reshaping Shadow Volumes with IOCTLs.txt
1.5 KiB
2021-05-21 - Dumping Stored Credentials with SeTrustedCredmanAccessPrivilege.pdf
194 KiB
2021-07-23 - Modifying MS Office security warnings.PNG
45 KiB
2021-08-03 - Reading, Writing, and Executing A File WITHOUT A File Path - yarhLoader.c
39 KiB
2021-10-10 - SeManageVolumePrivilege Abuse with FSCTL_SD_GLOBAL_CHANGE.zip
2.2 KiB
2021-12-07 - Demonstrating USB Propagation.7z
269 KiB
2021-12-07 - Programmatically Modifying Boot Configurations - BCDEdit.7z
6.7 KiB
2021-12-07 - The hidden side of Seclogon part 2 - Abusing leaked handles to dump LSASS memory.pdf
1018 KiB
2021-12-07 - Weaponizing Windows Virtualization.7z
219 KiB
2022-01-15 - Programmatically Stopping Windows Defender.7z
158 KiB
2022-02-09 - Hooks-On Hoot-Off Vitaminizing MiniDump.pdf
578 KiB
2022-02-17 - The magic behind wlrmdrexe.pdf
175 KiB
2022-02-25 - LogNT32 - Part 2 - Return-address hijacking implemented to improve efficiency.pdf
216 KiB
2022-03-26 - Digging into PssCaptureSnapshot for LSASS Dumping.pdf
353 KiB
2022-04-03 - FveApiDLL Abuse Demonstration.7z
287 KiB
2022-04-30 - Programmatically Hiding Windows Snapshots.7z
255 KiB
2022-05-31 - Crashing Windows by Abusing NtRaiseHardError.PNG
168 KiB
2022-06-28 - The hidden side of Seclogon part 3 - Racing for LSASS dumps.pdf
928 KiB
2022-08-19 - Bypassing AppLocker by abusing HashInfo.pdf
968 KiB
2022-08-29 - DLL Sideloading ShellChromeAPI.PNG
75 KiB
2022-10-07 - Short term snapshot deletion via ExecuteScheduledSPPCreation.7z
218 KiB
2022-10-11 - Abusing the Windows Power Management API.7z
155 KiB
2022-10-28 - Using Windows IUIAutomation for spyware and other malicious purposes.html
12 KiB
2022-11-02 - IIS Pool Credential Dumping via undocumented command line arguments.7z
102 KiB
2022-12-07 - Programmatically Deleting Shadow Volumes - Xaoc.7z
10 KiB
2022-12-16 - Polyshell - Bash, Batch, and Powershell Polyglot.zip
34 KiB
2023-02-03 - Windows Domain Controller NTDSUTIL activate instance abuse.PNG
177 KiB
2023-03-19 - Different ways to create a process.html
80 KiB
2023-05-02 - Preventing application creation by IFEO keys.png
94 KiB
2023-06-05 - Abusing undocumented features to spoof PE section headers.pdf
222 KiB
2023-07-19 - Escalating Privileges via Third-Party Windows Installers.pdf
3.3 MiB
2023-08-28 - Uac bypass via UIPI or Windows Task Manager.txt
7.5 KiB
2023-09-06 - How to Troll an AV.7z
4.8 KiB
2023-09-14 - Bypassing UAC with SSPI Datagram Contexts.pdf
1.3 MiB
2023-10-03 - LPE with MSI Installers.pdf
6.0 MiB
2023-11-06 - Running PEs Inline Without a Console.pdf
765 KiB
2023-12-19 - SignToolEx - code signing with leaked certs and abusing MS detours.zip
458 KiB
2023-12-24 - Arbitrary Command Execution Via Windows Kit's StandaloneRunner.pdf
386 KiB
2023-12-29 - Usermode encryption but only LOCALSYSTEM can decrypt.7z
172 KiB
2023-12-31 - Compression using undocumented RDP APIs.7z
3.1 KiB
2024-01-06 - Token stealing with Syscalls only.7z
67 KiB
2024-01-22 - Demonstrating proxy DLL loading.zip
5.8 KiB
2024-01-23 - Windows Event Log service DoS.zip
1.6 MiB
2024-01-24 - Demonstrating Remote TLS Callback Injection.zip
9.7 KiB
2024-02-08 - Bypassing ApplyOnce limitation in GPO with key removal.7z
227 KiB
2024-02-08 - Disabling System Event Logs with IDataCollectorSet.7z
79 KiB
2024-02-08 - Executing CSharp Assemblies from C code.pdf
431 KiB
2024-02-24 - iExpress LOLBINS and Diamond seds.7z
273 KiB
2024-03-08- Manipulating Token Attribute structures.7z
186 KiB
2024-03-18 - Abusing SeTrustedCredmanAccessPrivilege to dump user creds.zip
10 KiB
2024-08-08 - Abusing Windows Hello without a severed hand.7z
2.8 MiB
2024-08-15 - Offline SAM Editing.pdf
301 KiB
2024-08-19 - DRMBIN - Prevent binaries from running on other machines.zip
15 KiB
2024-08-26 - DLL Sideloading ith LicenseDiag.exe.7z
130 KiB