can1357/CVE-2018-8897

Stars
408
Rank 105,946 (Top 3 %)
Language
C++
License
BSD 3-Clause "New...
Created over 6 years ago
Updated over 6 years ago

can1357/CVE-2018-8897

can1357

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Arbitrary code execution with kernel privileges using CVE-2018-8897.

CVE-2018-8897

Demo exploitation of the POP SS vulnerability (CVE-2018-8897), leading to unsigned code execution with kernel privilages.

KVA Shadowing should be disabled and the relevant security update should be uninstalled.
This may not work with certain hypervisors (like VMWare), which discard the pending #DB after INT3.

Detailed explanation:

https://blog.can.ac/2018/05/11/arbitrary-code-execution-at-ring-0-using-cve-2018-8897/

Result:

NoVmp

A static devirtualizer for VMProtect x64 3.x. powered by VTIL.

ThePerfectInjector

Literally, the perfect injector.

ByePg

Defeating Patchguard universally for Windows 8, Windows 8.1 and all versions of Windows 10 regardless of HVCI.

NtRays

Hex-Rays microcode plugin for automated simplification of Windows Kernel decompilation.

NtLua

Lua in kernel-mode because why not.

haruspex

Exploration of x86-64 ISA using speculative execution.

linux-pe

COFF and Portable Executable format described using standard C++ with no dependencies.

simple_cnn

Simple Convolutional Neural Network Library

HexSuite

Header only wrapper around Hex-Rays API in C++20.

physical_mem_controller

A library to read physical memory and system-wide virtual memory.

vmware-rpc

Header-only VMWare Backdoor API Implementation & Effortless VMX Patcher for Custom Guest-to-Host RPCs

IdaThemer

🎨 Seamlessly convert your favorite Visual Studio Code themes to IDA Pro themes.

safe_capcom

Capcom wrapper with safety in mind.

xstd

A portable header only library extending the C++20 STL.

hvdetecc

Collection of hypervisor detections

llvm-patches

Personal curation of Clang/LLVM patches.

selene

Kernel-mode Paravirtualization in Ring 2, LLVM based linker, and some other things!

troto

TypeScript to Protobuf transpiler.

gengo

Generate Go bindings for shared C libraries.

retro

Experimental static analysis framework.

Myelin

Header-only CUDA accelerated DNN library

turing-incomplete

xedpp

Tiny wrapper around xed API.