Search Results for "windows kernel"

MemProcFS-Analyzer is a forensic analysis toolset that builds on the MemProcFS virtual filesystem to make volatile memory artefacts easier to browse and interpret. By exposing process memory, kernel objects, and derived artifacts as regular files, the framework lets analysts use familiar filesystem operations and standard tools (editors, grep, diff) to explore memory snapshots. The Analyzer layer adds higher-level parsing and extraction routines—for example, carving strings, locating...

PrivescCheck is a local privilege escalation reconnaissance tool for Unix-like systems that automates common checks auditors and system owners run when looking for misconfigurations. It enumerates kernel versions, installed packages, SUID/SGID binaries, world-writable files and directories, services, cron jobs, and user/group permissions to highlight likely escalation paths. The output is organized and human-readable so operators can triage findings quickly—flagging high-risk items...

A kernel for your device

PowerShell-Suite is a curated collection of PowerShell utility scripts and modules created to provide low-level Windows API access, process manipulation, debugging detection, security operations, and post-exploitation techniques directly from PowerShell. The project is licensed under BSD-3-Clause. Among its components, there are scripts like Invoke-Runas (to launch processes under alternate credentials via CreateProcessWithLogonW), Invoke-CreateProcess (to spawn processes with fine control over flags, window state, etc.), Detect-Debug (to detect kernel or user mode debugging environments), Get-Handles (to enumerate handles in a process via NtQuerySystemInformation), Get-TokenPrivs (to inspect privileges on process tokens), Get-Exports (to parse DLL exports without loading DLLs), Masquerade-PEB (to alter the PEB of a process to appear as a different process), and UAC-TokenMagic (a method to bypass UAC via token manipulation).