dpapi-ng

dpaping - Python DPAPI-NG De-/Encryption Library Library for DPAPI NG, also known as CNG DPAPI, de- and encryption in Python. It is designed to replicate the behaviour of NCryptUnprotectSecret and NCryptProtectSecret. This can be used on non-Windows hosts to de-/encrypt DPAPI NG protected secrets...

effective-waffle

effective-waffle yet another sleep encryption thing. also used the default github repo name for this one. TpAllocWork + TpPostWork + TpWaitForWork + TpReleaseWork to create + execute + clean the callback. The callback is some scuffed assembly that queues up a ton of rop gadgets that will pop...

BLACKHAT_Asia2023

BLACKHATAsia2023 Just About BLACKHAT USA2022 PDF Public File List, Search what your intersting. BLACKHATAsia2023 ├── AS-23-Babkin-firmWar-An-Imminent-Threat-to-the-Foundation-of-Computing.pdf ├── AS-23-Bai-Stealthy-Sensitive-Information-Collection-from-Android-Apps.pdf ├──...

CVE-2024-22894

CVE-2024-22894 Downloaded the latest heatpump firmware version wp2reg-V3.88.0-9015 of https://www.heatpump24.com/DownloadArea.php. Within this firmware is a file called : wp2reg-V3.88.0-9015\wp2reg-AlphaInnotech-prod\home.wp2reg-V3.88.0-9015221213\share\shadow This contains a 3DES encrypted...

Tourmaline

Tourmaline I recently stumbled upon a piece of cleverly designed malware that calls itself "Tourmaline". This README is very kindly written by Claude as I was super busy with exams at the time of this repository's inception. Exploiting and decrypting this malware took a huge chunk of my time from...

zoshrinkC2

MeliziaC2 DNS over HTTPS targeted malware only runs once ! Some functions are not available yet ! ! WIP, don't use in production ! Key Features Auto-delete malware on failure Fully encrypted per victim RSA key DoH DNS-over-HTTPS communication Malware only runs once! Diagram Images Requires...

Percino

Percino Evasive Golang Loader Percino is a Golang loader that execute shellcode utilizing the process hollowing technique with anti-sandbox and anti-analysis measures. The shellcode is encrypted with the Triple DES 3DES encryption algorithm. Full EDR bypass with any C2 Framework. Tested with Coba...

usbkill

« usbkill » es un interruptor de seguridad anti-forense que espera un cambio en tus puertos USB y, a continuación, apaga inmediatamente tu ordenador. Para ejecutarlo: sudo python usbkill.py o sudo python3 usbkill.py Proyecto relacionado; la misma idea, pero implementada como un controlador de...

usbkill

« usbkill » is an anti-forensic kill-switch that waits for a change on your USB ports and then immediately shuts down your computer. To run: sudo python usbkill.py or sudo python3 usbkill.py Related project; same idea, but implemented as a Linux driver: https://github.com/NateBrune/silk-guardian...

voidsec-proxy

voidsec-proxy ██╗ ██╗ ██████╗ ██╗██████╗ ███████╗███████╗ ██████╗ ██║ ██║██╔═══██╗██║██╔══██╗██╔════╝██╔════╝██╔════╝ ██║ ██║██║ ██║██║██║ ██║███████╗█████╗ ██║ ╚██╗ ██╔╝██║ ██║██║██║ ██║╚════██║██╔══╝ ██║ ╚████╔╝ ╚██████╔╝██║██████╔╝███████║███████╗╚██████╗ ╚═══╝ ╚═════╝ ╚═╝╚═════╝...

rust_citadel

Citadel Post-quantum hybrid encryption and key management server. Citadel combines X25519 + ML-KEM-768 for key encapsulation and AES-256-GCM for data encryption, following NIST's hybrid approach for the post-quantum transition. Applications encrypt and decrypt data through a REST API. Citadel...

YellowKey-Bitlocker

🔑 YellowKey-Bitlocker - Manage BitLocker security on Windows systems 🛡️ What is YellowKey-Bitlocker? YellowKey-Bitlocker is a program for Windows 10 and Windows 11. It helps users secure drives against the CVE-2026-45585 vulnerability. This issue affects how BitLocker manages drive encryption...

CVE-2026-63573

Observable discrepancy in the CMS RSA PKCS1 v1.5 key-transport unwrap KeyTransRecipientInformation.UnwrapKey in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who holds a captured CMS EnvelopedData message, and who can submit many modified messages to an...

PatchlessCLRLoader

PatchlessCLRLoader PatchlessCLRLoader is a fork of InlineExecute-Assembly to load .NET assembly and direct the output to mailslot. I rewrites it to a standalone loader with the following implementation: AES encryption payload Fileless payload support Patchless AMSI and ETW bypass using hardware...

EUVD-2026-91224

Observable discrepancy in the CMS RSA PKCS1 v1.5 key-transport unwrap KeyTransRecipientInformation.UnwrapKey in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who holds a captured CMS EnvelopedData message, and who can submit many modified messages to an...

CVE-2026-63573 Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap

Observable discrepancy in the CMS RSA PKCS1 v1.5 key-transport unwrap KeyTransRecipientInformation.UnwrapKey in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who holds a captured CMS EnvelopedData message, and who can submit many modified messages to an...

CVE-2026-63573 Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap

Observable discrepancy in the CMS RSA PKCS1 v1.5 key-transport unwrap KeyTransRecipientInformation.UnwrapKey in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who holds a captured CMS EnvelopedData message, and who can submit many modified messages to an...

CVE-2026-16001

The Bouncy Castle Inc. bc-csharp library (versions before 2.7.0 ) is vulnerable to a message authentication key exposure in the IesEngine stream mode. Specifically, when an IesEngine is constructed without a block cipher, the MAC key is taken from the key derivation output immediately following a...

DotNET_XorCryptor

DotNET XorCryptor You can also pay attention to an older project - NET-MalwareCryptor This is a .NET executable packer with payload encryption. Use for educational purposes only. How to use? --file path - specify file name --flood - add junk classes to file --proxy - move original entry point to...

Christmas

Maldev Academy Maldev Academy Home Maldev Academy Syllabus Christmas Implementing an injection method mentioned by @Hexacorn. This PoC creates multiple processes, where each process performs a specific task as part of the injection operation. Each child process will spawn another process and pass...