├── README.md ├── driver ├── binary │ └── i386 │ │ └── vulnwindrv.sys └── source │ ├── driver.c │ ├── dumbfunc.c │ ├── makefile.def │ ├── sources │ └── vulnwindrv.h └── exploit ├── 01_bad_request.py ├── 02_good_request_with_subcall2.py ├── 03_good_request_with_subcall3_to_debug.py ├── 04_evil_subcall1_to_controlled_eip.py ├── 05_evil_subcall1_to_nops.py ├── 06_evil_subcall1_to_shellcode.py └── 07_evil_subcall1_to_shellcode_and_shell.py /README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/andrewkabai/vulnwindrv/HEAD/README.md -------------------------------------------------------------------------------- /driver/binary/i386/vulnwindrv.sys: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/andrewkabai/vulnwindrv/HEAD/driver/binary/i386/vulnwindrv.sys -------------------------------------------------------------------------------- /driver/source/driver.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/andrewkabai/vulnwindrv/HEAD/driver/source/driver.c -------------------------------------------------------------------------------- /driver/source/dumbfunc.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/andrewkabai/vulnwindrv/HEAD/driver/source/dumbfunc.c -------------------------------------------------------------------------------- /driver/source/makefile.def: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/andrewkabai/vulnwindrv/HEAD/driver/source/makefile.def -------------------------------------------------------------------------------- /driver/source/sources: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/andrewkabai/vulnwindrv/HEAD/driver/source/sources -------------------------------------------------------------------------------- /driver/source/vulnwindrv.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/andrewkabai/vulnwindrv/HEAD/driver/source/vulnwindrv.h -------------------------------------------------------------------------------- /exploit/01_bad_request.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/andrewkabai/vulnwindrv/HEAD/exploit/01_bad_request.py -------------------------------------------------------------------------------- /exploit/02_good_request_with_subcall2.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/andrewkabai/vulnwindrv/HEAD/exploit/02_good_request_with_subcall2.py -------------------------------------------------------------------------------- /exploit/03_good_request_with_subcall3_to_debug.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/andrewkabai/vulnwindrv/HEAD/exploit/03_good_request_with_subcall3_to_debug.py -------------------------------------------------------------------------------- /exploit/04_evil_subcall1_to_controlled_eip.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/andrewkabai/vulnwindrv/HEAD/exploit/04_evil_subcall1_to_controlled_eip.py -------------------------------------------------------------------------------- /exploit/05_evil_subcall1_to_nops.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/andrewkabai/vulnwindrv/HEAD/exploit/05_evil_subcall1_to_nops.py -------------------------------------------------------------------------------- /exploit/06_evil_subcall1_to_shellcode.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/andrewkabai/vulnwindrv/HEAD/exploit/06_evil_subcall1_to_shellcode.py -------------------------------------------------------------------------------- /exploit/07_evil_subcall1_to_shellcode_and_shell.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/andrewkabai/vulnwindrv/HEAD/exploit/07_evil_subcall1_to_shellcode_and_shell.py --------------------------------------------------------------------------------