CVE-2024-49138

This exploit targets CVE-2024-49138, a privilege escalation vulnerability in Microsoft Windows 11 23H2's CLFS.sys driver. It manipulates kernel memory to elevate privileges by overwriting thread structures and token values.

The repository contains a functional exploit PoC for CVE-2024-49138, targeting a Windows kernel vulnerability. The code demonstrates kernel memory manipulation and privilege escalation techniques, including token swapping and arbitrary memory write operations.

The repository contains only a minimal README file with no exploit code or technical details. It appears to be a placeholder or scrapped project.

This repository provides a detailed SOC investigation report on a PowerShell-based attack chain involving CVE-2024-49138, including IOCs, MITRE ATT&CK mapping, and a timeline of events. It documents the use of EDRFreeze for defense evasion but does not contain exploit code.

The repository contains a functional exploit PoC for CVE-2024-49138, targeting a Windows kernel vulnerability. The code demonstrates kernel memory manipulation and token privilege escalation techniques, indicating a local privilege escalation (LPE) exploit.

This repository provides a detailed technical analysis of a simulated security incident involving CVE-2024-49138, a privilege escalation vulnerability in the Windows Common Log File System (CLFS) driver. It includes investigation steps, process analysis, network activity, and mitigation recommendations.

This repository provides a detailed technical analysis of an intrusion involving CVE-2024-49138, a CLFS privilege escalation vulnerability. It includes a timeline of the attack, evidence of exploitation, and indicators of compromise.

This repository provides a detailed incident response investigation of CVE-2024-49138, a privilege escalation vulnerability in the Windows CLFS driver. It includes indicators of compromise, tool usage, and process analysis but lacks functional exploit code.

This repository documents an incident response case involving CVE-2024-49138, focusing on logon failures, malware detection, and containment efforts. It provides detailed analysis of commands, processes, and MITRE ATT&CK mappings but lacks functional exploit code.

The repository contains a functional exploit PoC for CVE-2024-49138, targeting a Windows kernel vulnerability. The code includes kernel memory manipulation techniques, handle enumeration, and token privilege escalation logic, indicating a local privilege escalation (LPE) exploit.