ShellGhost

ShellGhost A memory-based evasion technique which makes shellcode invisible from process start to end. Motivation I wanted to share this shellcode self-injection POC to showcase some AV/EDR evasion concepts that may turn useful for Red Teaming. Just a few weeks ago I came up with a custom in-memo...

CVE-2017-5638

CVE-2017-5638 | Struts s2-045 Description It is possible to perform a RCE attack with a malicious Content-Type value. If the Content-Type value isn't valid an exception is thrown which is then used to display an error message to a user. Affected versions Struts 2.3.5 Struts 2.3.31 Struts 2.5 Stru...

VectoredOverloading

VectoredOverloading Vectored Overloading is a local PE injection technique that was first observed in the KidKadi malware. It works by manipulating the load of a legitimate DLL using Hardware Breakpoints HWBP and Vectored Exception Handling VEH to change the DLL section object on-the-fly...

instrumentation_callbacks

instrumentationcallbacks Instrumentation callbacks are quite a fun undocumented part of Windows. All the code in this repository is released under the MIT license. This repository uses google style C++ spacing. PRs are welcome if you find issues, bugs, or believe a specific feature should be adde...

CVE-2026-100300

A flaw was found in Apache ZooKeeper. An unauthenticated remote attacker can exploit improper handling of exceptions in the quota subsystem by writing to the default world-writable quota directory. This action crashes the primary request-processing thread and renders the on-disk data unbootable,...

Vectored-Exception-Handling-Squared

Vectored Exception Handling Squared A Rust Proof of Concept. Read more on my blog, all original research by CrowdStrike, this is just the POC for it! Unless I am blind; there does not seem to be much out there POC's etc relating to the discovery made by CrowdStrike researchers, called Vectored...

Apache-Dubbo-Hessian2-CVE-2021-43297

Deserialization during Apache Dubbo Hessian2 Exception Handling CVE-2021-43297 1. Import the two projects into two separate IDEA instances 2. First run org.apache.dubbo.samples.basic.BasicProvidermain to start the server 3. Then run org.apache.dubbo.samples.basic.BasicConsumermain to start the...

xmlrpc-bruteforcer

An XMLRPC BruteForcer for Wordpress - Inpired by 1N3@CrowdShield Note - This project is discontinued Usage python3 xmlrcpbruteforce.py http://wordpress.org/xmlrpc.php passwords.txt username python3 xmlrpcbruteforce.py http://wordpress.org/xmlrpc.php passwords.txt userlist.txt in progess Target is...

moonwalk

moonwalk: DLL Base Address Finder This Rust library and CLI tool demonstrates an alternative method to find the base address of loaded DLLs without using a Process Environment Block PEB walk. This technique is particularly useful in scenarios where PEB walking might be detected or blocked. Branch...

TamperingSyscalls

TamperingSyscalls TamperingSyscalls is a 2 part novel project consisting of argument spoofing and syscall retrival which both abuse EH in order to subvert EDRs. This project consists of both of these projects in order to provide an alternative solution to direct syscalls. Tampering with syscalls...

struts2_cve-2017-5638

struts2cve-2017-5638 This is a sort of Java porting of the Python exploit at: https://www.exploit-db.com/exploits/41570/. This software is written to have no external dependencies. DISCLAIMER This tool is intended for security engineers and appsec guys for security assessments. Please use this to...

CVE-2024-52316

🚨🚨CVE-2024-52316🚨🚨 🚨🚨CVE-2024-52316 - Apache Tomcat Authentication Bypass Vulnerability Overview CVE202452316 is an authentication bypass vulnerability identified in Apache Tomcat. This issue arises when Tomcat is configured with a custom Jakarta Authentication formerly JASPIC ServerAuthContext...

DigitalBazaar Forge improper exception handling vulnerability

Versions of DigitalBazaar Forge prior to 1.4.1 contain an improper exception handling vulnerability. This vulnerability arises because the TLS client checks for an error attribute when determining whether a server certificate is missing. A malicious TLS server or peer on the path can omit the...

Parse Platform parse-server improper exception handling vulnerability

Versions prior to 8.6.106 and versions 9.0.0 through 9.10.5-alpha.7 of the Parse Platform contain an improper exception handling vulnerability. This vulnerability arises from inadequate handling of null or undefined point notation keys when storing objects; as a result, writes are stored but...

Bytecode Alliance wasmtime improper exception handling vulnerability

The Bytecode Alliance Wasmtime versions prior to 46.0.0 through 48.0.6 and 49.0.0 through 49.0.3 contain an improper exception handling vulnerability. This vulnerability stems from a legacy assertion within component::Func::call that disallows guest exports when asynchronous ABI options are used...

ggml llama.cpp improper exception handling vulnerability

Versions of ggml llama.cpp from b2877 up to and including b11935 contain an improper exception handling vulnerability. This vulnerability arises because the ggml-rpc server fails to catch exceptions; an unauthenticated remote attacker can send a SETTENSOR command with a length exceeding...

RT-Labs p-net improper exception handling vulnerability

Versions prior to RT-Labs p-net 1.0.3 contain an improper exception handling vulnerability. This vulnerability arises when the application has registered a read callback; in such cases, pffspmcmreadind dereferences an empty AR pointer when processing an implicit read request lacking a valid targe...

RT-Labs p-net improper exception handling vulnerability

Versions prior to RT-Labs p-net 1.0.3 contain an improper exception handling vulnerability. This vulnerability arises when processing implicit read requests targeting AR records; if a valid target AR UUID is missing, it dereferences a NULL AR pointer. As a result, remote unauthenticated attackers...

Bytecode Alliance wasmtime improper exception handling vulnerability

In Bytecode Alliance Wasmtime versions prior to 46.0.0 and between 46.0.0 and 48.0.6, as well as versions between 49.0.0 and 49.0.3, there is an improper exception handling vulnerability. This vulnerability arises because when a guest task has not yet started, cleanup code searches for work items...

Bytecode Alliance wasmtime improper exception handling vulnerability

In Bytecode Alliance Wasmtime versions 49.0.0 through 49.0.3, there is an improper exception handling vulnerability. This vulnerability arises when fused adapters interleave strings such that the source and target are aliases of each other; this can lead to a host crash during string transmission...