79 matches found
CVE-2025-21420-PoC
CVE-2025-21420 PoC Windows ディスク クリーンアップ ツールの特権昇格の脆弱性 私の知る限り、不完全ではありますが、これはこのCVEに対する最初のPoCです。 https://nvd.nist.gov/vuln/detail/CVE-2025-21420 https://vulners.com/cve/CVE-2025-21420 cleanmgr.exe を使用してDLLサイドローディングを行う方法を見つけました。 $ cp .\dokan1.dll C:\Users\System32\System32\System32\dokannp1.dll $...
WFH
Windows Feature Hunter WFH Windows Feature Hunter WFH는 Frida, 동적 계측 도구 키트를 사용하여 Windows 실행 파일 내의 일반적인 "취약점" 또는 "기능"을 잠재적으로 식별하는 데 도움을 주는 개념 증명 파이썬 스크립트입니다. WFH는 현재 대규모로 잠재적인 DLLDynamic Linked Library 사이드로딩 및 COMComponent Object Model 하이재킹 기회를 자동으로 식별할 수 있습니다. DLL 사이드로딩은 Windows side-by-sideWinSXS...
Chimera
Chimera Unlea$ed 도구 배경 DLL 사이드로딩은 프로그램이 정상적으로 작동하는 데 필요한 라이브러리를 로드하는 등 합법적인 목적으로 사용될 수 있지만, 악의적인 목적으로도 사용될 수 있습니다. 공격자는 DLL 사이드로딩을 이용해 대상 시스템에서 임의 코드를 실행할 수 있으며, 이는 주로 DLL을 로드하는 데 사용되는 합법적인 애플리케이션의 취약점을 악용하여 이루어집니다. DLL 사이드로딩 프로세스를 자동화하고 더 효과적으로 만들기 위해 Chimera가 개발되었습니다. 이 도구는 EDR/AV 제품을 우회하기 위한 회...
malware-analysis-fake-hwmonitor
脅威分析: 偽のHWMonitor DLLサイドローディング & インフォスティーラーキャンペーン ⚠️ 免責事項 / ПРЕДУПРЕЖДЕНИЕ このリポジトリは、教育、防御、および脅威リサーチの目的に厳密に限定して作成されています。技術的な事後分析、侵害指標 IoC、および防御用のYARAシグネチャを含みます。このリポジトリには、アクティブなマルウェアバイナリは一切配布されていません。 📌 エグゼクティブサマリー / Краткая сводка このリポジトリは、ハードウェア診断ユーティリティ CPUID HWMonitor 架空のバージョン 6.77.7...
CVE-2026-3796
CVE-2026-3796 QAXウイルス除去ツールの2025年10月22日以前のバージョンにおいて、影響を受けるドライバQKSecureIOImp.sysは、呼び出し元プロセスのイメージに基づいてミニフィルタードライバとの通信を許可するかどうかを判断します。攻撃者は、DLLサイドローディングやプロセスインジェクションなどの手法を通じて正当な呼び出し元プロセスのイメージを偽装し、特定のペイロードを含むメッセージをミニフィルターに送信して、保護されたプロセスなどの任意のプロセスを終了させることができます。 背景...
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures
Threat actors are abusing ChatGPT Custom GPTs to disguise them as legitimate product offerings and direct unsuspecting victims to malicious sites that employ ClickFix lures to deliver malware. Huntress, which observed the activity in late September 2026, said it marks the abuse of yet another...
NimDllSideload
Nim DLL サイドローディング このリポジトリを使用すると、サイドローディング/プロキシローディングに利用できる Nim DLL を簡単に生成できます。 DLL サイドローディングに詳しくない場合は、こちらのブログ記事をご覧ください。 どうやって使うのか？ プロキシしたい正規の DLL（または複数の DLL）をこのリポジトリの build ディレクトリに置き、make を実行してください。 これにより、out ディレクトリに2つの .dll が生成されます。 ランダムな名前のものは、関数呼び出しがプロキシされる元の DLL です。 もう1つはあなたのペイロードになります。...
OneDriveUpdaterSideloading
OneDriveUpdater DLL Sideloading このリポジトリには、OneDriveUpdater.exe/OneDriveStandaloneUpdater.exe 用の version.dll を DLL サイドローディングするためのソースコードが含まれています。 ペイロードは、PaloAltoNetworks Unit42 のブログ記事で概説されているサブルーチンに基づいています。 このペイロードに関する私のブログ記事:...
Linux Distros Unpatched Vulnerability : CVE-2026-59781
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access...
CVE-2026-59781
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...
CVE-2026-59781
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...
CVE-2026-59781 Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...
CVE-2026-59781
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...
EUVD-2026-60742
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...
CVE-2026-59781
The Zabbix Agent on Windows is vulnerable to DLL sideloading because the installer fails to verify if a custom installation directory has secure access permissions. An attacker could exploit this by placing a malicious DLL in a directory with insecure permissions, which the application might subs...
CVE-2026-59781 Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...
CVE-2026-59781
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...
CVE-2026-59781: Uncontrolled Search Path Element
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...
PT-2026-76964
Name of the Vulnerable Software and Affected Versions Zabbix Agent affected versions not specified Description When installed on Windows in a custom directory, the installer fails to verify if the selected location has secure access permissions. This allows an attacker to place a malicious DLL in...
Signed, sealed, injected: The mechanics of DCRat in 2026
Signed, sealed, injected: The mechanics of DCRat in 2026 By Madhini Muralidharan, Shalaka Patil and Kaushal Sarda · August 13, 2026 Introduction In early 2026, the Trellix Advanced Research Center ARC identified and analyzed an active DarkCrystal RAT DCRat campaign following a critical customer...