FSecureLABS/KernelFuzzer

Stars
440
Rank 99,050 (Top 2 %)
Language
C
License
Other
Created over 8 years ago
Updated about 6 years ago

FSecureLABS/KernelFuzzer

FSecureLABS

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Cross Platform Kernel Fuzzer Framework

KernelFuzzer

This is the core Kernel Fuzzer, with example library calls and Syscalls to start fuzzing Windows. The fuzzer has been tested on Windows 7 / 10, OS X and QNX.

#Getting started

Download and install Python 3.5
Compile binary for your system using the included .bat scripts for the correct architecture (Windows only!). Tested using Visual Studio 2013 - if you use a different version of VS, edit the script to point at your copy of 'vcvarsall.bat'.
Run worker_setup/worker_setup.py

The script should setup the VM as required, reboot and start the fuzzer.

#Writing modules / syscalls

See our Def Con 24 slides over at [MWR Labs] (https://labs.mwrinfosecurity.com/publications/platform-agnostic-kernel-fuzzing/) which give an explanation of the fuzzer and examples of writing library calls and syscalls for the fuzzer. One of each is provided as an example and more examples are provided in the slides.

#Database If you wish to send your crashes to a CouchDB instance, this needs to be setup seperately, then edit the bughunt_loop.py scipt with the required information.

#Contact Feel free to submit issues or ping us on Twitter - [@NerdKernel] (https://twitter.com/NerdKernel) / [@munmap] (https://twitter.com/munmap).

SharpGPOAbuse

SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.

dref

DNS Rebinding Exploitation Framework

win_driver_plugin

A tool to help when dealing with Windows IOCTL codes or reversing Windows drivers.

wePWNise

WePWNise generates architecture independent VBA code to be used in Office documents or templates and automates bypassing application control and exploit mitigation software.

OSXFuzz

macOS Kernel Fuzzer

Azurite

Enumeration and reconnaissance activities in the Microsoft Azure Cloud.

Ninjasploit

A meterpreter extension for applying hooks to avoid windows defender memory scans

z3_and_angr_binary_analysis_workshop

Code and exercises for a workshop on z3 and angr

SharpClipHistory

SharpClipHistory is a .NET application written in C# that can be used to read the contents of a user's clipboard history in Windows 10 starting from the 1809 Build.

XRulez

A command line tool for creating malicious outlook rules

drozer-modules

ViridianFuzzer

Kernel driver to fuzz Hyper-V hypercalls

incognito

One Token To Rule Them All https://labs.mwrinfosecurity.com/blog/incognito-v2-0-released/

CVE-2018-4121

macOS 10.13.3 (17D47) Safari Wasm Exploit

GWTMap

CVE-2016-7255

An exploit for CVE-2016-7255 on Windows 7/8/8.1/10(pre-anniversary) 64 bit

N1QLMap

The tool exfiltrates data from Couchbase database by exploiting N1QL injection vulnerabilities.

SharpGPO-RemoteAccessPolicies

A C# tool for enumerating remote access policies through group policy.

defcon25_uac_workshop

UAC 0Day all day!

3d-accelerated-exploitation

3D Accelerated Exploitation

Athena

GUI Tool to generate threat intelligence information in various formats

honeypot_recipes

A chef cookbook which can be used to quickly deploy a high interaction honeypot, using the sysdig and falco tools

needle-agent

The iOS Agent for the Needle Security Assessment Framework

CalendarPersist

JXA script to allow programmatic persistence via macOS Calendar.app alerts.

coralsun

macOS Cython IOKit Utility Library

avrop

ROP based Movfuscator VM

mercury-modules

Extra modules for the Mercury Android Security Assessment Framework.

jASMin

fdpasser

Example of passing file descriptors into a container to perform a privilege escalation on the host

tapjacking-poc

fingertec-tool

A tool for communicating with FingerTec access control devices, as well as other ZKTeco based devices

gists

Short handy snippets from the @mwrlabs team

timeinator

Timeinator is an extension for Burp Suite that can be used to perform timing attacks over an unreliable network such as the internet.

weasel

veripy

a network-centric compliance testing framework for verifying the operation of network equipment against the RFCs specified in ripe-554

Ellume-COVID-Test_Research-Files

jar-agent

mercury-common

This repository contains Mercury components that are shared between the Agent and the Server/Console.

mwr-tls

A collection of utilities for interacting with SSL and X509 Certificates on Android.

bsides18_breakfree

Example tools and output from BSides 2018 "I Want to Break Free"

Cisco-UCM-SQLi-Scripts

Scripts that can be used to exploit CVE-2019-15972 which was an Authenticated SQLi issue in Cisco Unified Call Manager (UCM).

rogue-agent

ByteConverter

Re-Desk-v2.3-Vulnerabilities