How 1dotq/windows-eventlog-blinding works
This is a single-file, authorized-lab research PoC for probing a potential Windows Event Log denial of service through MS-EVEN6. Its workflow validates the lab target and explicit confirmation, resolves the RPC endpoint, optionally authenticates with NTLM, then submits an oversized query and reports the outcome. The graph stays small because the repository has one runtime module; Windows services and Impacket are external dependencies. Relationships are based on the excerpted script and README.
Main entry points: poc_even6_crash.py Query probe
Components 8
PoC workflow
- CLI validation
poc_even6_crash.py - Private target guard
poc_even6_crash.py - Endpoint discovery
poc_even6_crash.py - RPC bind
poc_even6_crash.py - Query probe
poc_even6_crash.py
Other components
- Lab operator
- Impacket RPC
- Windows Event Log
Connections 10
- Lab operator → CLI validation: supplies options
poc_even6_crash.py - CLI validation → Private target guard: validates target
poc_even6_crash.py - CLI validation → Query probe: invokes probe
poc_even6_crash.py - Endpoint discovery → Impacket RPC: maps endpoint
poc_even6_crash.py - Query probe → Endpoint discovery: resolves endpoint
poc_even6_crash.py - RPC bind → Impacket RPC: binds RPC
poc_even6_crash.py - Query probe → RPC bind: establishes session
poc_even6_crash.py - Query probe → Impacket RPC: sends query
poc_even6_crash.py - Impacket RPC → Windows Event Log: calls MS-EVEN6
README.md - Windows Event Log → Query probe: returns outcome