Our Research
A novel Double Hijacking technique
Introduction Double Hijacking combines a user-mode call redirect with a hijack of a kernel service table. The first hijack changes how an application reaches a native call. The second changes...
A novel Double Hijacking technique
Introduction Double Hijacking combines a user-mode call redirect with a hijack of a kernel service table. The first hijack changes how an application reaches a native call. The second changes...
CVE-2026-13043 Kernel Memory Access
Discovered by: Juan Sacco Vendor: Panda Antivirus Security / WatchGuard Component: Panda Kernel Memory Access Driver Driver module: pskmad.sysCVE: 2026-13043 CVSS Score: 9.3Link: https://psirt.watchguard.com/CVE-2026-13043 CVE Summary A missing authentication vulnerability in...
CVE-2026-13043 Kernel Memory Access
Discovered by: Juan Sacco Vendor: Panda Antivirus Security / WatchGuard Component: Panda Kernel Memory Access Driver Driver module: pskmad.sysCVE: 2026-13043 CVSS Score: 9.3Link: https://psirt.watchguard.com/CVE-2026-13043 CVE Summary A missing authentication vulnerability in...
Subverting the Windows Kernel: Juan Sacco's Res...
At BruCON 2026, the principal developer of Exploit Pack, Juan Sacco, presented Subverting the Windows Kernel: When VBS, HVCI and kCET Are Enabled, a research talk exploring the limitations of modern Windows kernel...
Subverting the Windows Kernel: Juan Sacco's Res...
At BruCON 2026, the principal developer of Exploit Pack, Juan Sacco, presented Subverting the Windows Kernel: When VBS, HVCI and kCET Are Enabled, a research talk exploring the limitations of modern Windows kernel...
From Integer Overflow to Arbitrary Kernel VA Re...
By Juan Sacco from Exploit Pack <jsacco@exploitpack.com> While researching the latest Pwn2Own disclosures, I came across CVE-2026-62735, an integer-overflow vulnerability in HTTP.sys, the Windows kernel HTTP protocol stack. The vulnerability...
From Integer Overflow to Arbitrary Kernel VA Re...
By Juan Sacco from Exploit Pack <jsacco@exploitpack.com> While researching the latest Pwn2Own disclosures, I came across CVE-2026-62735, an integer-overflow vulnerability in HTTP.sys, the Windows kernel HTTP protocol stack. The vulnerability...
Asustek Kernel Driver Asio3.sys 0-day vulnerabi...
While researching the ASUS AsIO and AsIO2 driver families, I focused on their relevance and PA capabilities. Both are signed kernel drivers with privileged hardware-access capabilities, and applicable builds can...
Asustek Kernel Driver Asio3.sys 0-day vulnerabi...
While researching the ASUS AsIO and AsIO2 driver families, I focused on their relevance and PA capabilities. Both are signed kernel drivers with privileged hardware-access capabilities, and applicable builds can...
Abusing VBS Enclaves: Data-Only Execution and V...
By Juan Sacco from Exploit Pack Interested in Windows Kernel? Check out our Technical Training Courses. What happens when an untrusted VTL0 host gains read/write access to a VBS enclave,...
Abusing VBS Enclaves: Data-Only Execution and V...
By Juan Sacco from Exploit Pack Interested in Windows Kernel? Check out our Technical Training Courses. What happens when an untrusted VTL0 host gains read/write access to a VBS enclave,...
Technical Training
-
Windows Kernel Exploitation I
Regular price €600Regular price -
Vulnerability Hunting for the Windows Kernel
Regular price €600Regular price -
Windows Kernel Exploitation II
Regular price €600Regular price
