WFH

Windows Feature Hunter WFH Windows Feature Hunter WFHは、動的インストルメンテーションツールキットであるFridaを使用して、Windows実行ファイル内の一般的な「脆弱性」または「機能」を潜在的に特定するための概念実証Pythonスクリプトです。WFHは現在、大規模に潜在的なDynamic Linked Library（DLL）サイドローディングおよびComponent Object Model（COM）ハイジャックの機会を自動的に識別する機能を備えています。 DLLサイドローディングは、Windows...

Chimera

Chimera Unlea$ed ツールの背景 DLLサイドローディングは、プログラムの動作に必要なライブラリをロードするなど、正当な目的で使用されることもありますが、悪意のある目的にも使用される可能性があります。攻撃者は、DLLサイドローディングを使用して、多くの場合、DLLをロードするために使用される正当なアプリケーションの脆弱性を悪用し、対象システム上で任意のコードを実行する可能性があります。...

CVE-2025-21420-PoC

CVE-2025-21420 PoC Vulnerabilidad de Elevación de Privilegios en la Herramienta de Liberación de Espacio en Disco de Windows Hasta donde sé, aunque incompleto, este es el primer PoC para esta CVE. https://nvd.nist.gov/vuln/detail/CVE-2025-21420 https://vulners.com/cve/CVE-2025-21420 Encontramos u...

OneDriveUpdaterSideloading

OneDriveUpdater DLL 侧载 本仓库包含用于对 OneDriveUpdater.exe/OneDriveStandaloneUpdater.exe 执行 DLL 侧载 version.dll 的源代码。 该载荷基于 PaloAltoNetworks Unit42 的 博客文章 中概述的子程序。 我关于此载荷的博客文章：https://blog.sunggwanchoi.com/recreating-an-iso-payload-for-fun-and-no-profit/ version 修改自 Flangvik 的 SharpDLLProxy 所生成的代理 DLL...

CVE-2026-3796

CVE-2026-3796 In QAX Virus Removal version dated 2025-10-22 and earlier, the affected driver QKSecureIOImp.sys rely on caller process's image to determine whether they are allowed to communicate to the mini filter driver. Attackers could impersonate a legitimate caller process image through tacti...

NimDllSideload

Nim DLL 侧加载 此仓库可让你轻松生成可用于侧加载/代理加载的 Nim DLL。 如果你不太了解什么是 DLL 侧加载，可以看看这篇博客文章。 我该如何使用？ 将你想要代理的合法 DLL（或多个 DLL）放入此仓库的 build 目录，然后运行 make。 这将在 out 目录中生成两个 .dll： 名称随机的那一个是原始 DLL，函数调用将被代理到它 另一个将是你的有效载荷 如果侧加载成功，你应该会看到一个消息框弹出和/或一个文件被写入桌面。 要实际“武器化”有效载荷，你可以查看 OffensiveNim 仓库获取思路和现成的代码片段 :。 它是如何工作的？ dllproxy.n...

CVE-2026-59781

When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...

CVE-2026-59781 Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.

When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...

CVE-2026-59781

The Zabbix Agent Windows installer did not validate directory permissions during custom-path installation, allowing attackers to drop a malicious DLL that gets loaded by the agent, enabling arbitrary code execution. The fix detects unsafe directories and requires explicit user confirmation before...

EUVD-2026-60742

When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...

PT-2026-76964

Name of the Vulnerable Software and Affected Versions Zabbix Agent affected versions not specified Description When installed on Windows in a custom directory, the installer fails to verify if the selected location has secure access permissions. This allows an attacker to place a malicious DLL in...

Signed, sealed, injected: The mechanics of DCRat in 2026

Signed, sealed, injected: The mechanics of DCRat in 2026 By Madhini Muralidharan, Shalaka Patil and Kaushal Sarda · August 13, 2026 Introduction In early 2026, the Trellix Advanced Research Center ARC identified and analyzed an active DarkCrystal RAT DCRat campaign following a critical customer...

China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks

An exposed Alibaba Cloud server has revealed a China-nexus operation that Group-IB tracks as JadeProx. The cluster has targeted government, healthcare, and education organizations across Asia and Latin America with a previously undocumented Windows loader called TriBack Loader. Group-IB found the...

Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT

A suspected China-nexus threat activity cluster has been observed targeting Indian taxpayers, tax professionals, and corporate finance teams to deliver a remote access trojan designed to steal sensitive data from compromised hosts. The multi-stage campaign, codenamed Operation DragonReturn by...

Windows-privilege-exploits

Elevation !Windowshttps://img.shields.io/badge/platform-Wi...

CVE-2026-33156

ScreenToGif is a screen recording tool. In versions from 2.42.1 and prior, ScreenToGif is vulnerable to DLL sideloading via version.dll . When the portable executable is run from a user-writable directory, it loads version.dll from the application directory instead of the Windows System32...

CVE-2026-33156 DLL Sideloading in ScreenToGif

ScreenToGif is a screen recording tool. In versions from 2.42.1 and prior, ScreenToGif is vulnerable to DLL sideloading via version.dll . When the portable executable is run from a user-writable directory, it loads version.dll from the application directory instead of the Windows System32...

CVE-2026-33156

CVE-2026-33156 affects ScreenToGif (portable versions up to 2.42.1). The flaw is DLL sideloading through version.dll: when run from a user-writable directory, the executable loads version.dll from its own directory instead of Windows System32, enabling arbitrary code execution in the user’s conte...

Hackers Use LinkedIn Messages to Spread RAT Malware Through DLL Sideloading

Cybersecurity researchers have uncovered a new phishing campaign that exploits social media private messages to propagate malicious payloads, likely with the intent to deploy a remote access trojan RAT. The activity delivers "weaponized files via Dynamic Link Library DLL sideloading, combined wit...

CVE-2022-23748

mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under what conditions. In these scenarios, a malicious attacker could be using the valid and legitimate executable to load malicious files...