HookDump

HookDump EDR function hook dumping Please refer to the Zeroperil blog post for more information https://zeroperil.co.uk/hookdump/ Building source In order to build this you will need Visual Studio 2019 community edition is fine and CMake. The batch file Configure.bat will create two build...

IATelligence

IATelligence IATelligence는 PE 파일에서 Import Address TableIAT을 추출하고 OpenAI의 GPT-3 모델을 사용하여 파일이 가져온 각 Windows API에 대한 세부 정보를 제공하는 Python 스크립트입니다. 이 스크립트는 또한 관련 MITRE ATT&CK 기술을 검색하고 해당 API가 공격자에 의해 어떻게 사용될 수 있는지 설명합니다. 또한 파일의 해시를 표시하고 GPT-3 요청 비용을 추정합니다. IATelligence는 GPT-3를 악성코드 분석에 사용하고 IAT를 기반으로...

DRMBinViaOrdinalImports

DRMBinViaOrdinalImports - 복사 방지 DRM 악성코드 생성 빠른 링크 Maldev Academy 홈 Maldev Academy 강의 계획서 Maldev Academy 가격 요약 이 저장소는 프로그램의 Import Address TableIAT에서 가져온 함수 이름을 해당 서수ordinal로 대체하여, 오직 서수를 통해서만 함수를 가져오는 바이너리를 생성하는 기술을 사용합니다. 이 기술은 시스템마다 서수 값이 일치하지 않기 때문에 샌드박스 시스템이 바이너리를 성공적으로 분석할 가능성을 줄여줍니다. 이러한 불일...

IAT-Hook

후킹 - IAT 후킹 후킹은 사용자가 프로그램의 실행 흐름을 리다이렉트할 수 있게 해주는 기법이다. 대부분의 경우 우리는 함수 후킹을 사용한다. 우리는 함수를 우리 자신의 함수로 교체하거나 리다이렉트할 것인데, 이는 매우 유용하며 다양한 사용 사례를 가지고 있다. 후킹에는 여러 가지 방법이 있는데, 여기서는 IAT Hooking을 살펴본다. 이는 Import Address Table의 약자이다. 이는 런타임에 채워지는 큰 테이블에서 함수의 주소를 우리 자신의 주소로 교체하는 것으로 구성된다. 다른 저장소에서 이전에 언급했듯이,...

EUVD-2026-46429

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow out-of-bounds READ exists in decodercontext::decodesliceunitWPP in libde265/decctx.cc. When decoding a WPP Wavefront Parallel Processing HEVC slice, ctbAddrRS is computed as...

Gray-Box Poisoning of Continuous Malware Ingestion Pipelines

Modern malware detection pipelines rely on continuous data ingestion and machine learning to counter the high volume of novel threats. This work investigates a realistic gray-box poisoning threat model targeting these pipelines. Using the secmlmalware framework, we generate problem-space...

CVE-2025-60686

A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers A720R V4.1.5cu.614B20230630, LR1200GB V9.1.0u.6619B20230130, and NR1800X V9.1.0u.6681B20230703. Both programs parse the contents of /proc/net/arp using sscanf with "%s" format...

PT-2025-46856

A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers A720R V4.1.5cu.614 B20230630, LR1200GB V9.1.0u.6619 B20230130, and NR1800X V9.1.0u.6681 B20230703. Both programs parse the contents of /proc/net/arp using sscanf with "%s"...

EUVD-2005-0116

Malware in sbrugna...

EUVD-2005-0141

Malware in sbrugna...

EUVD-2017-3811

Malware in sbrugna...

EUVD-2025-31030

Malicious code in bioql PyPI...

CVE-2025-20316

A vulnerability in the access control list ACL programming of Cisco IOS XE Software for Cisco Catalyst 9500X and 9600X Series Switches could allow an unauthenticated, remote attacker to bypass a configured ACL on an affected device. This vulnerability is due to the flooding of traffic from an...

CVE-2025-20316

A vulnerability in the access control list ACL programming of Cisco IOS XE Software for Cisco Catalyst 9500X and 9600X Series Switches could allow an unauthenticated, remote attacker to bypass a configured ACL on an affected device. This vulnerability is due to the flooding of traffic from an...

CVE-2025-20316

CVE-2025-20316 describes a vulnerability in the ACL programming of Cisco IOS XE Software on Cisco Catalyst 9500X and 9600X Series Switches. The issue allows an unauthenticated, remote attacker to bypass a configured egress ACL. The root cause is tied to traffic flooding from an unlearned MAC addr...

CVE-2025-20316: Improper Access Control

A vulnerability in the access control list ACL programming of Cisco IOS XE Software for Cisco Catalyst 9500X and 9600X Series Switches could allow an unauthenticated, remote attacker to bypass a configured ACL on an affected device. This vulnerability is due to the flooding of traffic from an...

CVE-2023-46354

In the module "Orders CSV, Excel Export PRO" ordersexport 5.2.0 from MyPrestaModules for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can access exports from the module which can lead to a leak of personal information fro...

CVE-2023-45380

In the module "Order Duplicator " Clone and Delete Existing Order" orderduplicate in version = 1.1.7 from Silbersaiten for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can download personal information from...

PT-2023-29537 · Prestashop · Order Duplicator Module

Name of the Vulnerable Software and Affected Versions: Order Duplicator module for PrestaShop versions = 1.1.7 Description: The issue allows a guest to download personal information without restriction due to a lack of permissions control. This includes accessing data from the ps customer and ps...

PrestaShop Order Duplicator Security Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, SMS alerts, and product image zoom and other features. A security vulnerability exists in PrestaShop Order Duplicator - Clone and Delete Existing Order...