Matthieu Buffet

adeleg. Active Directory delegation management tool

ntsec. Standalone tool to explore the security model of Windows and its NT kernel. Use it to introspect privilege assignments and access right assignments, enumerate attack surfaces from the point of view of a sandboxed process, etc.

evtq. Windows eventlog formatting, live fetching and querying utility in C

winsddl. Windows Security Descriptor Definition Language (SDDL) parser and formatter

libiris. libiris is a cross-platform sandboxing library, intended as a not-for-production harness with a low barrier to entry

win32k-mitigation. A test project to try the new win32k.sys system call filtering mitigation in Windows 10

lsobj. Lists all visible objects in the Windows kernel object namespace, a command-line WinObj

captrace. Lists capabilities used by processes on your system as they are requested, to assist in the task of creating custom hardened profiles for containers and sandboxes.

muslkl. A unikernel builder based on MUSL + LKL, designed to run any vanilla application inside an SGX enclave

nt-object-types. Toy project to explore the NT kernel's object types and their security access rights

dracut-dropbear-unlock. A minimalist dracut module that allows you to remotely unlock an encrypted root partition during boot.

windows-service-dll. Minimal Windows service boilerplate packaged as DLL

windows-service. Minimal Windows service boilerplate

tristitude. A simple process security policy enumerator. This project has been superseded by https://github.com/mtth-bfft/ntsec , which now has the same functionalities and many more :)

seccomp-dump. A small utility to fetch the raw seccomp BPF filter program used by a thread from the kernel

dyndnsmon. Live monitor for failed dynamic DNS updates on Windows Server

kblist. Windows Update website crawler to list security updates by version and type (cumulative/non-cumulative)

tpm-otp. A minimal tool that communicates with your TPM during boot, to display a one-time password and prove bootchain integrity.

seccomp-analyze. A seccomp BPF filter verifier written in Prolog, to parse, analyze and list system calls and arguments allowed by a given filter.

repadmin-parser. Minimal Python parser for Microsoft's repadmin replication metadata listings

simplvpn. A standalone script to manage OpenVPN server and client configurations.

ipc-benchmarks. Benchmarks for various IPC mechanisms on various OSes

dotfiles. .files, sensible default configuration files and customisations that I use on all my machines

sandboxing-pocs. Various not-for-production proofs of concept around sandboxing

lapsus. A standalone miniature tool to reset the local administrator password of each computer in your Windows fleet to a random value, stored encrypted in a central registry (on a network share, for instance).