github.comrepo

nbs32k/LocalStranger

LocalStranger is a proof-of-concept exploit toolkit targeting WinNotify.sys, a Microsoft Windows Hardware Compatibility Publisher-signed kernel driver the author says has no caller validation and exposes arbitrary kernel read/write, memory allocation, physical/virtual memory access and KASLR bypass primitives. The project includes lsapi, a user-mode wrapper library for these driver communications, lsmapper, a C++ tool that maps unsigned kernel drivers into kernel space using the vulnerable driver, and a separate C program that elevates the current user to NT-AUTHORITY privileges. The driver is not yet on the Microsoft Vulnerable Driver Blocklist, and the code is released without a license.