UsoDllLoader

UsoDllLoader ⚠️ 2020-06-06 Update: this trick no longer works on the latest builds of Windows 10 Insider Preview. This means that, although it still works on the mainstream version of Windows 10 , you should expect it to be patched in the coming months. Description This PoC shows a technique that...

Malicious code in nebulallm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5428d0f2f07674817697574b1993211dfa902bad746d8cd6efc1ad6b1fbbfd90 nebulallm 1.4.3 presents itself as an AI API client stub but ships a custom install command class in setup.py that executes on pip install. The insta...

CVE-2024-6473-PoC

CVE-2024-6473 PoC Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used. Vulnerable browser version !IMPORTANT The Internet must be turned off during installation, otherwise the browser will be updated. You can download vulerable...

Perfusion

Perfusion On Windows 7 , Windows Server 2008R2 , Windows 8 , and Windows Server 2012 , the registry key of the RpcEptMapper and DnsCache 7/2008R2 only services is configured with weak permissions. Any local user can create a Performance subkey and then leverage the Windows Performance Counters to...

DragonCastle

DragonCastle A PoC that combines AutodialDLL lateral movement technique and SSP to scrape NTLM hashes from LSASS process. Description Upload a DLL to the target machine. Then it enables remote registry to modify AutodialDLL entry and start/restart BITS service. Svchosts would load our DLL, set...

LdrLibraryEx

LdrLibraryEx A small x64 library to load dll's into memory. Features low dependencies & function use only ntdll.dll used position independent code lightweight and minimal easy to use load modules from memory load modules from disk api sets support bypass image load callbacks using private memory...

GoDefender

🛡️ GoDefender 🛡️ A powerful Go-based security toolkit designed to detect and defend against debugging, virtualization, and DLL injection attacks. GoDefender provides comprehensive protection mechanisms to make reverse engineering and analysis significantly more difficult. ⚠️ WINDOWS ONLY - Designed...

DumpChromeSecrets

!IMPORTANT This project is no longer maintained. Please useDumpBrowserSecrets instead, which supports Chrome, Edge, Brave, Firefox, Opera, Opera GX, and Vivaldi. DumpChromeSecrets Extract data from modern Chrome versions, including refresh tokens, cookies, saved credentials, autofill data, browsi...

invoker

Invoker Penetration testing utility and antivirus assessment tool. Built with Visual Studio Community 2022 v17.5.4 64-bit and tested on Windows 10 Enterprise OS 64-bit. Made for educational purposes. I hope it will help! This repository started to have known signatures and I don't have time to...

GoRedOps

GoRedOps Telegram: https://t.me/ebytelabs GoRedOps is a collection of Golang projects designed specifically for red teamers and offensive security operations. This repository provides various tools and techniques essential for penetration testing, exploitation, and security research. Table of...

China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors

Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025. "The most distinctive technical marker for Bronze Sandcastle is its consistent us...

CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities KEV catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell. The vulnerabilities are listed below -...

Siemens Software Center Uncontrolled Search Path Code Execution

The vulnerability of the software for loading, installing, and activating Siemens Software Center is related to an uncontrolled element in the search process. Exploiting this vulnerability allows a perpetrator to execute arbitrary code with elevated privileges using a specially created DLL file...

ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan

Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 CVSS v4 score: 8.4, could allow an attacker to place a specially-crafted DLL in a directory the...

CVE-2026-102438

An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library DLL that is later loaded by a high-privilege process. Refer to the ' Security Update for Armoury Crate App ' sectio...

EUVD-2026-104782

An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library DLL that is later loaded by a high-privilege process. Refer to the ' Security Update for Armoury Crate App ' sectio...

CVE-2026-102438

An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library DLL that is later loaded by a high-privilege process. Refer to the ' Security Update for Armoury Crate App ' sectio...

CVE-2026-102438

The ASUS Armoury Crate application is susceptible to an uncontrolled search path element vulnerability (CWE-427). This flaw allows local users to execute arbitrary code with SYSTEM privileges by replacing a dynamic-link library (DLL) that is subsequently loaded by a high-privilege process. Remedi...

PT-2026-118095

Name of the Vulnerable Software and Affected Versions ASUS Armoury Crate affected versions not specified Description An uncontrolled search path element issue allows local users to execute arbitrary code with SYSTEM privileges. This occurs through the replacement of a dynamic-link library DLL,...

firefox: thunderbird: Privilege escalation in the DLL Services component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DLL Services component...