windows security research framework. built on Win11 25H2 (Build 26200.5603, Defender 4.18.26060). pure Python stdlib + ctypes, no pip installs.
the interesting part of this project is the research, not the framework. detailed writeups are in research/.
four bugs in the Desktop Activity Moderator kernel driver, all reachable from medium integrity level with no special privileges:
| ID | bug | impact | validation |
|---|---|---|---|
| K1 | confused deputy -- enroll any process into DAM job | DoS on arbitrary processes | TRIGGER |
| K2 | session freeze via state IOCTL | ~10x slowdown on enrolled processes | manual |
| K3 | NULL deref via crafted IOCTL | BugCheck 0x3B (instant BSOD) | manual (destructive) |
| K4 | PsQueryProcessCommandLine for arbitrary PIDs | credential/token leak from privileged processes | IMPACT |
see research/dam-sys.md for IOCTL details, access requirements, and reverse engineering notes.
| ID | technique | needs | validation |
|---|---|---|---|
| D1 | signature freeze from medium IL | user | IMPACT |
| D2 | oplock quarantine bypass | user | STATE |
| D3 | NTLM coercion via scan path | admin + listener | manual |
| D4 | ETW surveillance on engine provider | admin | TRIGGER |
| D5 | scan pause | admin | TRIGGER |
see research/defender-primitives.md.
| ID | technique | validation | notes |
|---|---|---|---|
| E1 | UAC bypass (mock trusted directory) | TRIGGER | known technique -- see research/uac-bypass-e1.md |
| W1 | WER report staging | STATE | staging primitive, no code exec chain yet |
| W2 | WER trigger | manual | |
| N1 | WNF cross-privilege trigger | TRIGGER | state names may vary between builds |
python nightfall.py validate
python nightfall.py validate --target D1
three result tiers:
- IMPACT -- test proves the end-to-end security consequence
- STATE -- test verifies the mutation but not the downstream effect
- TRIGGER -- API call succeeded, no further verification
also SKIP (missing prereqs) and FAIL. AMSI and ETW tests restore original bytes after verification. K3 is excluded (destructive).
the validation suite covers: D1, D2, D4, D5, E1, K1, K4, W1, N1, AMSI, ETW.
not covered: D3 (needs external listener), K2/K3 (destructive), W2, and all experimental features. this is the biggest gap in the project.
the framework implements ~60 standard post-exploitation techniques. these are not original research -- they are public tradecraft implemented from documentation and prior work.
evasion: AMSI/ETW patching (byte mod and hardware breakpoint variants), ntdll unhook, indirect syscalls, module stomping, sleep obfuscation, PEB masquerade
injection: CRT, APC, early bird, thread hijack, module stomping
credentials: SAM dump, LSASS dump, browser creds (DPAPI+AES-GCM), registry creds, wifi passwords
persistence: Run key, scheduled task, time provider DLL, WER handler, SSP/AP package
C2: HTTPS beacon (WinHTTP), named pipe, WNF state, kernel pool dead drop, clipboard
lateral: SCM service create, WMI exec, WinRM exec
kernel (BYOVD): RTCore64.sys loader, DKOM process/thread hiding, ETW-TI kill, callback removal, minifilter blinding
anti-forensics: event log clear, timestomp (API and raw MFT), artifact wipe, shadow delete
see the interactive help (python nightfall.py interactive, then help)
for the full command list.
each feature is marked with its validation status:
| level | meaning |
|---|---|
| VALIDATED (IMPACT) | test proves end-to-end security consequence |
| VALIDATED (STATE) | test verifies mutation, not downstream effect |
| VALIDATED (TRIGGER) | API call accepted, no further verification |
| FUNCTIONAL | manually tested, no automated validation |
| EXPERIMENTAL | known limitations, hardcoded offsets, or incomplete |
| SCAFFOLD | setup/registration works, core mechanism not implemented |
experimental features are documented honestly -- limitations, failure modes, and what would break are called out in the code and in the README sections below.
- experimental features have no automated validation tests
- kernel DKOM operations (process hide, thread hide, handle hide, callback nuke, minifilter blind) use heuristic offset scanning with no build-matrix verification
- ProjFS callbacks don't serve file data (scaffold only)
- kernel pool dead drop writes to unowned memory (corruption risk)
- process hollowing has no relocation support
- process doppelganging does not initialize process parameters
nightfall.py # legacy entry point (also works standalone)
nightfall/
__init__.py # package exports
__main__.py # python -m nightfall support
constants.py # ctypes definitions, WIN32 constants, API signatures
core.py # Nightfall class (all methods)
cli.py # argparse, interactive mode, command dispatch
research/ # detailed findings documentation
docs/ # validation model, technique reference
uac_poc/ # Rust DLL for E1 UAC bypass
python nightfall.py interactive
python -m nightfall interactive
or run commands directly:
python nightfall.py validate
python nightfall.py freeze
python nightfall.py elevate
python nightfall.py ghost
- docs/validation.md -- validation model explained
- docs/techniques.md -- detailed technique reference
cd uac_poc
cargo build --release
- Python 3.8+
- Windows 11 25H2
- Rust toolchain (for uac_poc only)
- no external Python dependencies
MIT. see LICENSE.
authorized security research only. do not use on systems you do not own or have written permission to test.