{"uuid": "ffde6f67-d774-436c-8b55-2a7f3973e63c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-30804", "type": "seen", "source": "https://t.me/zero_cipher/275", "content": "A look at the features and structure of phoenix and how to compile and use it:\n\nPart 1 (related to kernel and bypass):\n\n1.1 UEFI Bootkit Load drivers from ESP before booting Windows\n\n1.2 Disabling Secure Boot Changing UEFI variables to bypass Secure Boot\n\n1.3 Disabling HVCI Patching BCD and Kernel to disable Hypervisor-protected Code Integrity\n\n1.4 Disabling DSE Patching the CiValidateImageHeader and CiGetPolicy functions in the kernel\n\n1.5 Patch Boot Manager Patching bootmgr to bypass Integrity Checks\n\n1.6 Spoof Driver Signature Replacing the driver signature with a Microsoft test signature\n\n1.7 Registering Boot Entry Persistence at the UEFI level by registering a new Boot Option\n\n1.8 Kernel DSE/KPP Bypass Directly patching kernel functions to disable PatchGuard\n\nPart 2 (token manipulation and privilege escalation):\n\n2.1 Token Stealing via DKOM Copying the SYSTEM token to the current process via EPROCESS\n\n2.2 Token Stealing Safe Copy token while preserving RefCount to prevent BSOD\n\n2.3 Token Duplication Create duplicate token with NtDuplicateToken\n\n2.4 Enable All Privileges Enable 15+ Privileges including SeDebug, SeTcb, SeLoadDriver\n\n2.5 CreateProcessWithToken Run process with arbitrary token (e.g. SYSTEM)\n\n2.6 30 Local PE Techniques including Unquoted Path, DLL Hijacking, Scheduled Task, WMI Event, Named Pipe, SAM Copy, LSASS Dump, AlwaysInstallElevated, Print Spooler, CVE-2024-26229, CVE-2025-7771, CVE-2024-30804, CVE-2024-35250 and ...\n\n2.7 30 Domain PE Techniques including Golden Ticket, Silver Ticket, Diamond Ticket, Skeleton Key, AD CS ESC1-ESC8, DCShadow, DCSync, Pass-the-Hash, Pass-the-Ticket, NTLM Relay, LDAP Injection, GPP Decryption and...\n\nPart 3 (hiding and dkom):\n\n3.1 Hide Process Remove process from ActiveProcessLinks with dynamic offset\n\n3.2 Hide Thread Remove thread from ETHREAD list with dynamic offset\n\n3.3 Hide Driver Remove driver from PsLoadedModuleList\n\n3.4 Hide File Hide files via File System Filter\n\n3.5 Hide Registry Key Hide registry keys via Registry Callbacks\n\n3.6 Hide Network Connection Hide network connections\n\n3.7 Patch 70+ Syscalls Patch NtQuerySystemInformation, NtOpenProcess, NtReadVirtualMemory, NtCreateFile, NtCreateKey, NtEnumerateKey and more than 70 other functions\n\n3.8 Patch PspCidTable Hide from Windows Handle Table\n\n3.9 Hide From Csrss Hide from Client/Server Runtime Subsystem\n\n3.10 Hide From Task Manager Hide from Task Manager via patch functions\n\nPart 4 (evasion):\n\n4.1 Remove EDR Callbacks Remove callbacks EDR from PspCreateProcessNotifyRoutine, PspCreateThreadNotifyRoutine, and PspLoadImageNotifyRoutine\n\n4.2 Patch AMSI Patch AmsiScanBuffer and AmsiScanString in amsi.dll\n\n4.3 Patch ETW Patch EtwEventWrite, EtwEventWriteFull, EtwEventWriteString, EtwEventWriteTransfer\n\n4.4 Syscall Hooks Hook 70+ Syscalls for hiding and control\n\n4.5 Call Stack Spoofing Spoof Call Stack with Vectored Exception Handler\n\n4.6 Indirect Syscall Execute Syscall without going to ntdll.dll\n\n4.7 Install VEH Install Vectored Exception Handler for Spoofing\n\n4.8 Enable All Evasion Enable all Evasion techniques at once", "creation_timestamp": "2026-08-18T00:00:13.157732Z"}