NimicStack

NimicStack NimicStack is the pure Nim implementation of Call Stack Spoofing technique to mimic legitimate programs. Whole project is based on the PoC shared by WithSecure Labs Compilation You can directly compile the source code with the following command: nim c -d=mingw --app=console --cpu=amd64...

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

ThreadStackSpoofer

Thread Stack Spoofing / Call Stack Spoofing PoC A PoC implementation for an advanced in-memory evasion technique that spoofs Thread Call Stack. This technique allows to bypass thread-based memory examination rules and better hide shellcodes while in-process memory. Intro This is an example...

LazyHook

Overview LazyHook is a stealthy API hooking framework that bypasses Host Intrusion Prevention Systems HIPS through call stack spoofing. By leveraging CPU-level hardware breakpoints and Vectored Exception Handling, it executes arbitrary code as if it originated from trusted, Microsoft-signed...

moneta

/ \ / | / \ / \ / \ / / \ \ / Y | \ /| | / | //| | / | / / / / / Moneta v1.0 | Forrest Orr | 2020 REQUIRED -m |region|referenced|ioc -p |PID OPTIONAL -v detail|debug|surface -d --option from-base|statistics --filter unsigned-module|clr-prvx|clr-heap|metadata-modules --address --region-size -m...

Shelter

Shelter Shelter is a completely weaponized sleep obfuscation technique that allows to fully encrypt your in-memory payload making an extensive use of ROP. This crate comes with the following characteristics: AES-128 encryption. Whole PE encryption capability. Removal of execution permission durin...

SilentMoonwalk

SilentMoonwalk PoC Implementation of a fully dynamic call stack spoofer TL;DR SilentMoonwalk is a PoC implementation of a fully dynamic call stack spoofer, implementing a technique to remove the original caller from the call stack, using ROP to desynchronize unwinding from control flow. Authors...

MassDriver

MassDriver 将敏感 API 调用从 shellcode 代理到 artifact，以生成兼容 CET 的干净调用栈。 配套博客文章的 PoC：Stop Being Weird — Life After Call Stack Spoofing Under CET。 构建 MinGW 无法设置 CET 兼容标志，因此你需要使用 llvm-mingw 来构建支持 CET 的版本。 默认使用 ./payload/testDll.c 作为载荷进行构建，该载荷会调用 LoadLibraryA 和 Sleep，方便你检查调用栈。 将你的 libtcg.x64.zip 副本放入 ./tcg/...

CallStackSpoofer

CallStackSpoofer 该仓库演示了一个 PoC 实现，用于在进行系统调用时伪造任意调用栈。完整的技术分析请参阅随附的博客文章：https://labs.withsecure.com/blog/spoofing-call-stacks-to-confuse-edrs。 默认情况下，它包含三个可供模仿的示例调用栈，可通过提供 --wmi、--rpc 或 --svchost 参数来选择，如下所示： 这些调用栈是通过启用进程访问事件的 SysMon 运行并搜索 lsass 为句柄操作目标的事件而获得的。 注意，作为提醒，此 PoC 已在以下 Windows 版本上测试：...

Unwinder

目录 SilentMoonWalk 描述 致谢 用法 callfunction! 宏 indirectsyscall! 宏 参数传递 示例 调用 kernel32.dll!Sleep 调用 kernel32.dll!OpenProcess 以间接系统调用方式调用 NtDelayExecution 串联宏调用 注意事项 初始帧 PoC 栈替换 技术描述 使用方法 实际示例 备注 SilentMoonWalk 描述 Unwinder 提供了对 SilentMoonWalk 技术的完整武器化实现，使得能够在 Rust 中获得完整且稳定的调用栈欺骗（call stack spoofing）。...

CallStackMasker

CallStackMasker Este repositorio demuestra una técnica de prueba de concepto PoC para suplantar dinámicamente pilas de llamadas mediante temporizadores. Antes de que nuestro implante entre en suspensión, podemos poner en cola temporizadores para sobrescribir su pila de llamadas con una falsa y...

CVE-2026-84851

An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service...

CVE-2026-84851

CVE-2026-84851 is an uncontrolled recursion vulnerability in the Ion reader component of Amazon Ion-C , affecting versions before 1.1.6 . A remote, unauthenticated attacker can craft malicious Ion data that exhausts the native call stack, causing a denial of service in any application using the l...

CVE-2026-84851 Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6

An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service...

PT-2026-84881

An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: sched/scs: The task stack state is reset in bringupcpu. When a CPU is hot-plugged, the idle task on that CPU calls several layers of C code before finally leaving the kernel. When KASAN is in use, a “poisoned” shadow is left behi...

EUVD-2026-63468

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values...

protobufjs: protobufjs: Denial of Service via crafted JSON descriptors

A flaw was found in protobufjs. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a crafted JSON descriptor with deeply nested namespace definitions. This can lead to the exhaustion of the JavaScript call stack during descriptor loading, making the...

SUSE CVE-2026-67313

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger...

CVE-2026-67313

A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a...