@ZeroMemoryEx

Cyber Security Consultant | Security Researcher

 Morocco
hackandhide.com
Joined December 2019
  • Tweets284
  • Following529
  • Followers2K
29Media
And since it's an arbitrary file deletion, we can easily use it to exploit the MSI installer rollback to achieve privilege escalation :) github.com/ZeroMemoryEx/IObi…
vx-underground
@vxunderground7 Jan 2025
Shoutout to the homies at "IObit Malware Fighter". Their IMFForceDelete driver is so wildly vulnerable, and poorly written, you can have their driver arbitrarily delete any file on the machine with 0 privileges and literally 1 line of code Thanks @_mmpte_software for sharing
5
78
2
328
33,457
I published a blog post explaining the features of Chaos-Rootkit and how each one works internally. hackandhide.com/chaos-rootki…

Chaos-Rootkit: Internals Explained

This write-up covers the internals of Chaos-Rootkit, a Ring-0 Windows rootkit I wrote to better understand kernel internals and rootkit techniques. Fun fact: Many parts of this rootkit were written...

hackandhide.com
10
42
2,861
I’ve released a PoC and a technical write-up for a local privilege escalation vulnerability I discovered last year and reported to Lenovo PSIRT, affecting many gaming laptop brands, including Lenovo, MSI, Thunderobot, and others. github.com/ZeroMemoryEx/CVE-…

GitHub - ZeroMemoryEx/CVE-2025-68921: Local Privilege Escalation Affecting Millions of Gaming...

Local Privilege Escalation Affecting Millions of Gaming Laptops - ZeroMemoryEx/CVE-2025-68921

github.com
3
34
123
9,113
write up hackandhide.com/cve-2025-689…

CVE-2025-68921: Local Privilege Escalation Affecting Millions of Gaming Laptops

Summary This write-up details a local privilege escalation vulnerability that I reported to Lenovo PSIRT in January of last year. The issue affects an audio enhancement software pre-installed on many...

hackandhide.com
1
8
859
Published a blog on my previous exploit. I've also discovered a privilege escalation vulnerability affecting MSI, Lenovo, ASUS, Alienware, Huawei laptops, and more. The vulnerability has been confirmed, stay tuned for the write-up once it's patched! hackandhide.com/from-dos-to-…

CVE-2025-26125: Turning DoS into Privilege Escalation

As always, while surfing X (formerly Twitter), I came across an interesting tweet from vx-underground that immediately caught my attention: "Shoutout to the homies at IObit Malware Fighter. Their...

hackandhide.com
2
33
1
147
9,466
It’s been a while since I posted any updates here, so here’s a recap. I’ve fixed errors and memory leaks, improved error handling, added file restriction and integrity bypass features, and implemented a driver swap for disk and memory for more detail,check github.com/ZeroMemoryEx/Chao…

GitHub - ZeroMemoryEx/Chaos-Rootkit: Now You See Me, Now You Don't

Now You See Me, Now You Don't . Contribute to ZeroMemoryEx/Chaos-Rootkit development by creating an account on GitHub.

github.com
4
26
134
10,844
Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes github.com/ZeroMemoryEx/Term…

GitHub - ZeroMemoryEx/Terminator: Reproducing Spyboy technique to terminate all EDR/XDR/AVs...

Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes - ZeroMemoryEx/Terminator

github.com
4
150
1
470
53,867
Tired by EDRs and AVs continuously flagging your executables? This program terminates protected anti-malware processes by exploiting the GMER driver github.com/ZeroMemoryEx/Blac…

GitHub - ZeroMemoryEx/Blackout: kill anti-malware protected processes ( BYOVD )

kill anti-malware protected processes ( BYOVD ) . Contribute to ZeroMemoryEx/Blackout development by creating an account on GitHub.

github.com
7
164
5
509
150,260
In this week’s red team tip. I will show how to use @ZeroMemoryEx AMSI Killer to patch AMSI and allow Invoke-Mimikatz to run. This attack does get detected by Windows Defender, but it’s too late as memory is already patched. #hacking #redteam youtu.be/QFp3ybRKr7Q
1
1
6
1,919
Lazarus-Tactic: program based on APT38 North Korea-backed hackers tactic that used in targeting security researchers using a malicious Visual Studio project file (vcxproj) to steal their 0days. github.com/ZeroMemoryEx/APT3…

GitHub - ZeroMemoryEx/APT38-0day-Stealer: APT38 Tactic PoC for Stealing 0days from security...

APT38 Tactic PoC for Stealing 0days from security researchers - ZeroMemoryEx/APT38-0day-Stealer

github.com
28
2
66
7,858
New AMSI lifetime bypass, it works by searching for the first byte of each instruction to prevent updates from affecting it, Check it out. #amsi #redteam #cybersecurity github.com/ZeroMemoryEx/Amsi…

GitHub - ZeroMemoryEx/Amsi-Killer: Lifetime AMSI bypass

Lifetime AMSI bypass. Contribute to ZeroMemoryEx/Amsi-Killer development by creating an account on GitHub.

github.com
6
178
5
489
59,194
Just published new blog post tinyurl.com/4ua23wzv! How can you hook systemcalls in kernel on Windows 11 22H2, how does Avast Free Antivirus use it and how you can bypass Avast’s self-defense in 10 lines of PowerShell code right now? All answers are provided in the article
3
114
3
264
it can be very annoying for analysts to wait for the malware to do its true malicious behavior,That's why i made this program that patch the Sleep function and speed up the execution ,check it out. github.com/ZeroMemoryEx/Slee… #malwareanalysis #cybersecurity #malwaredetection #redteam

GitHub - ZeroMemoryEx/SleepKiller: Bypass Malware Time Delays

Bypass Malware Time Delays. Contribute to ZeroMemoryEx/SleepKiller development by creating an account on GitHub.

github.com
2
27
2
73
The world of Ransomware is full of surprises: LockBit allegedly paid out their first “bug bounty” to someone who highlighted decryption flaws in the LB3 ESXi variant. The flaw made it possible to bypass having to pay the ransom for a key
15
185
46
602
Presenting D-Generate , syscall tracing as its supposed to be! raw.githubusercontent.com/jo… usage: dg cmd.exe - displays all syscalls done by process with cmd.exe as imagefile. dg 4736 - by pid 4736 dg - just everything example of recording: raw.githubusercontent.com/jo…
17
236
13
796
Zombie Processes scorpiosoftware.net/2022/05/…

Zombie Processes

The term “Zombie Process” in Windows is not an official one, as far as I know. Regardless, I’ll define zombie process to be a process that has exited (for whatever reason), but at…

scorpiosoftware.net
6
92
5
281
Arbitrary read/write -> arbitrary kernel-mode API calls with HVCI and Kernel CFG enabled :) - in this case a POC to invoke ZwOpenProcess on the System process in VTL 0. I will blog on this soon!
7
75
1
324
DirectX
4
6
183
👀 "This is essentially a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings)." github.com/Dec0ne/KrbRelayUp

GitHub - Dec0ne/KrbRelayUp: KrbRelayUp - a universal no-fix local privilege escalation in windows...

KrbRelayUp - a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings). - Dec0ne/KrbRelayUp

github.com
8
107
4
313
Unable to extract credentials via DPAPI or Mimikatz? Don't worry. Microsoft got your back. Just use 'rundll32 keymgr.dll, KRShowKeyMgr' to extract all the stored passwords on the host, be it a target server, FTP or chrome's HTTP creds, microsoft has you covered. #redteam
48
796
35
2,636
Load more