# 1dotq/windows-eventlog-blinding architecture

> Architecture diagram of the GitHub repository 1dotq/windows-eventlog-blinding, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-12). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/1dotq/windows-eventlog-blinding
- Repository: https://github.com/1dotq/windows-eventlog-blinding

## Overview

This is a single-file, authorized-lab research PoC for probing a potential Windows Event Log denial of service through MS-EVEN6. Its workflow validates the lab target and explicit confirmation, resolves the RPC endpoint, optionally authenticates with NTLM, then submits an oversized query and reports the outcome. The graph stays small because the repository has one runtime module; Windows services and Impacket are external dependencies. Relationships are based on the excerpted script and README.

Main entry points: [`poc_even6_crash.py`](https://github.com/1dotq/windows-eventlog-blinding/blob/main/poc_even6_crash.py) (Query probe)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_poc["PoC workflow"]
  node_cli["CLI validation<br/>[poc_even6_crash.py]"]
  node_target_guard["Private target guard<br/>[poc_even6_crash.py]"]
  node_endpoint["Endpoint discovery<br/>[poc_even6_crash.py]"]
  node_rpc_bind["RPC bind<br/>[poc_even6_crash.py]"]
  node_query_probe["Query probe<br/>[poc_even6_crash.py]"]
end

node_operator(("Lab operator"))
node_impacket["Impacket RPC"]
node_windows["Windows Event Log"]

node_operator -->|"supplies options"| node_cli
node_cli -->|"validates target"| node_target_guard
node_cli -->|"invokes probe"| node_query_probe
node_endpoint -->|"maps endpoint"| node_impacket
node_query_probe -->|"resolves endpoint"| node_endpoint
node_rpc_bind -->|"binds RPC"| node_impacket
node_query_probe -->|"establishes session"| node_rpc_bind
node_query_probe -->|"sends query"| node_impacket
node_impacket -->|"calls MS-EVEN6"| node_windows
node_windows -.->|"returns outcome"| node_query_probe

click node_cli "https://github.com/1dotq/windows-eventlog-blinding/blob/main/poc_even6_crash.py"
click node_target_guard "https://github.com/1dotq/windows-eventlog-blinding/blob/main/poc_even6_crash.py"
click node_endpoint "https://github.com/1dotq/windows-eventlog-blinding/blob/main/poc_even6_crash.py"
click node_rpc_bind "https://github.com/1dotq/windows-eventlog-blinding/blob/main/poc_even6_crash.py"
click node_query_probe "https://github.com/1dotq/windows-eventlog-blinding/blob/main/poc_even6_crash.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_target_guard,node_endpoint,node_rpc_bind,node_query_probe toneBlue
class node_operator,node_impacket,node_windows toneIndigo
```

## Components

### PoC workflow

- [CLI validation](https://github.com/1dotq/windows-eventlog-blinding/blob/main/poc_even6_crash.py): `poc_even6_crash.py`
- [Private target guard](https://github.com/1dotq/windows-eventlog-blinding/blob/main/poc_even6_crash.py): `poc_even6_crash.py`
- [Endpoint discovery](https://github.com/1dotq/windows-eventlog-blinding/blob/main/poc_even6_crash.py): `poc_even6_crash.py`
- [RPC bind](https://github.com/1dotq/windows-eventlog-blinding/blob/main/poc_even6_crash.py): `poc_even6_crash.py`
- [Query probe](https://github.com/1dotq/windows-eventlog-blinding/blob/main/poc_even6_crash.py): `poc_even6_crash.py`

### Other components

- **Lab operator**
- **Impacket RPC**
- **Windows Event Log**

## Connections

- Lab operator → CLI validation: supplies options (evidence: `poc_even6_crash.py`)
- CLI validation → Private target guard: validates target (evidence: `poc_even6_crash.py`)
- CLI validation → Query probe: invokes probe (evidence: `poc_even6_crash.py`)
- Endpoint discovery → Impacket RPC: maps endpoint (evidence: `poc_even6_crash.py`)
- Query probe → Endpoint discovery: resolves endpoint (evidence: `poc_even6_crash.py`)
- RPC bind → Impacket RPC: binds RPC (evidence: `poc_even6_crash.py`)
- Query probe → RPC bind: establishes session (evidence: `poc_even6_crash.py`)
- Query probe → Impacket RPC: sends query (evidence: `poc_even6_crash.py`)
- Impacket RPC → Windows Event Log: calls MS-EVEN6 (evidence: `README.md`)
- Windows Event Log → Query probe: returns outcome