ioncodes/CVE-2020-16938

Stars
183
Rank 210,154 (Top 5 %)
Language
C++
Created about 4 years ago
Updated over 1 year ago

ioncodes/CVE-2020-16938

ioncodes

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Bypassing NTFS permissions to read any files as unprivileged user.

CVE-2020-16938

CVE-2020-16938 is a vulnerability that allows you to get unrestricted file read capabilities on the entire disk as unprivileged user. The bug was originally found and reported by my friend Jonas. His PoC can be found here.

My version of the exploit consists of a bunch of Windows API calls to get the handle directly without using 7zip, the PoC can be found in the poc folder which mirrors the tweet I created a while ago.

In short, this exploit allows you to dump the entire disk. The dump in itself can be opened using 7zip or any other parser that supports NTFS.

idacode

An integration for IDA and VS Code which connects both to easily execute and debug IDAPython scripts.

dnpatch

.NET Patcher library using dnlib

ceload

Loading dbk64.sys and grabbing a handle to it

long_night

A collection of themes based on pastel colors, created for reverse engineers

vacation3-emu

VAC3 module emulator

llvm8

Statically recompiling CHIP8 to Windows and macOS using LLVM

BlueGate

PoC for the Remote Desktop Gateway vulnerability - CVE-2020-0609 & CVE-2020-0610

awesome-ui

A curated list of awesome UI libraries, frameworks & guidelines

SMBGhost

Scanner for CVE-2020-0796 - A SMBv3.1.1 + SMB compression RCE

beeless

BeeByte Deobfuscator. Used it to deobfuscate an Unity3D Game. Alternatively, de4dot works aswell.

kdbg-driver-vagrant

JodelAPI

API-Wrapper for the Jodel app in .NET

dbgmon

Allows you to parse all messages sent to DbgPrint without any process interaction.

pooldump

dlsym_hook

Instrumenting a binary without source code to bypass anti-debug checks

Curveball

PoC for CVE-2020-0601 - CryptoAPI exploit

RACEAC

Bypassing EAC integrity checks by abusing a TOCTOU in Dead by Daylight.

dnpatch.script

dnpatch script engine stand alone

kdbg-driver-workstation

rapid-kdbg-hyperv

master-duel

SteamManifestFixer

Patches Steam to download depot files without manifest data.

FallGuys

FallGuys cheat that used internal functions present in one of the first published releases of the game. Includes speed hacks and no-stun.

DeadByDaylight

Dead by Daylight utilities created while researching

excusemewtf

Our team's CTF writeups

Jupyter Notebook

rw

allowing um r/w through km from um ioctl ™

dnSpy.dnpatch

dnpatch plugin for dnSpy!

GitSpector

Desktop application to monitor Git repos and their build statuses, built with the power of Electron.

MaterialMessageBox

Custom QMessageBox/MessageDialog in QML for Qt Quick Controls 2.0

hidenseek

Playing hide and seek in kernel mode.

Maze

Wingman

The pluginbased Postman in C#

NeptuneCI

Fast Continuous Integration Solution for GitHub

Switcheroo

Steam account switcher

windows-driver-boilerplate-rs

pasted driver boilerplate

cve-info

Fetches information given a CVE

NETCompile

A library with functions to easily compile .NET apps/libs!

snesutilities

SNES Rom extraction utilites.

kernel

Header-only library that assists you with exploiting the Windows kernel

machina

Manage and execute assembly at runtime.

sam-rs

rust compiler plugin for compile time instruction assembling

llvm_test

Simple Hello World with LLVM

mmap-kernel-exploit

Gaining root by exploiting the mmap handler of a kernel module.

ll

is-vm

Detecting VMs using the CPUID instruction

Medusa

Medusa - .NET Multi-Scanner [BETA]

ionScript

My own scriptlanguage using .NET as interpreter.

sam

Compile time instruction assembler for Rust.

bn_memcpy

docker-compiler-explorer

dnSpyUpdater

Updater for dnSpy.

sbb

pub.ioncodes.com

The index page of my public projects website

uwu

I should have never named this uwu...

aseprite-ci

Build configurations to compile Aseprite via a GitLab CI Runner on Windows.

urldecode

Decodes a URL encoded String.

otf2ttf

Shell script for converting *.otf font files to *.ttf (Just want to get the SF font from my 🍎 on my Windows machine 😛)

ida_scripts

cpp-makefile-template

JodelWindows

Windows version of the Jodel app using my own API (JodelAPI on GitHub).

iRecover

Password Recovery utility and library writtin in .NET

RoguueLiike

Rogue-like game in MonoGame C#

brainfuck_recompiler

Brainfuck recompiler to x64 asm

Axon

Objective-C header file parser

sam-web

Online assembler

ioncodes

eta-wen

Xiu

gameboy emulator in Rust

ionTheme

C# and VB.NET Theme as replacement for the odd windows style

ctf

Docker image for CTFs

Quickie

Find icons from different icon sets.

Korpus

Has nothing to do with IKEA, it's a remote tool

iRC

Simple commandline irc client

Korpus.Server

Still has nothing to do with IKEA, it's the server for Korpus

efi-boilerplate

exploit-templates

Templates for binary exploits

CFade

Console Fader Animator class in C++

ProxyDB

Database that manages all your proxies.

wrapper

WinAPI C++ wrapper

bs

winconfig

My configs I use on Windows

nesextract

Tool to extract sprites from NES roms.

disrupt

Fast commandline disassembler

BeautySharpVS

Visual Studio Extension working with a PHP API for fast code publishing.

snek

Snek forwards your iOS notifcations to Snek Server, Slack or Discord. Built for iOS 11.

yolo

yolo like a hipster does demos in 2k17

yolo-rs

yolor - demotool

dnconventions

Convert the naming conventions of a .NET application