VehApiResolve

VehApiResolve 灵感源自 Dridex Loader 的 32 位 API 混淆。 这是如何工作的？ 我们设置一个异常处理程序。 root@kitploit: AddVectoredExceptionHandler CALLFIRST, ApiResolverHandler ; 该异常处理程序只会处理作为 EXCEPTIONBREAKPOINT 抛出的异常。当它由我们抛出时，我们能够捕获 CONTEXT。我们可以获取传递的参数。 RDX 和 R8 将保存我们的函数和模块哈希。然后我们可以使用 GetProcAddrExH 动态解析它们，如下所示 root@kitploit:...

CVE-2018-18912

🐞 CVE-2018-18912: Easy File Sharing Web Server 7.2 - スタックベースのバッファオーバーフロー SEH Easy File Sharing Web Server 7.2 における SEH ベースのバッファオーバーフロー。認証された HTTP POST パラメータが例外ハンドラチェーンを破壊する方法を示しています。 📑 目次 このリポジトリの存在理由 この脆弱性が興味深い理由 コンテキストと影響を受けるソフトウェア 脆弱性について クラッシュのトリガー エクスプロイト 🎓 このリポジトリの存在理由...

TestCitrixException

测试 Citrix 异常（测试 CVE-2025-6759 缓解措施） Citrix 关于 CVE-2025-6759 的文档包含通过从注册表禁用 Citrix 异常处理程序来实现的替代缓解措施。 然而，该文档并未回答这个问题： 此项更改是否需要重启 VDA 服务或服务器？ 因此，构建此工具正是为了对其进行测试。 来源： CTX676735 提供了有关该异常处理及其注册表键如何运作的更多信息。 来自 Rapid 7 的博客文章 告诉我们与此漏洞相关的进程是 GfxMgr.exe 和 CtxGfx.exe 注意！ 似乎文件 GfxMgr.exe 在未安装 HDX 3D Pro/HDX...

EATGuard

EATGuard 导出地址表保护缓解措施的一种实现，类似于导出地址过滤（EAF） 工作原理 本项目由三个二进制文件组成，编译后可在 EATGuard\bin\ 中找到。它们是： 1. EATGuardApplication.exe - 一个“恶意”应用程序，它将 EATGuardDll.dll 加载到进程中，然后执行一些可执行代码（shellcode），这些代码会运行 notepad.exe。 2. EATGuardDll.dll - 提供用户态与内核态之间“桥梁”的 DLL。该 DLL 注册了一个向量化异常处理程序（VEH），用于将对 kernel32.dll...

Voidgate

VOIDGATE 描述： 一种可用于绕过 AV/EDR 内存扫描器的技术。通过执行对单个加密汇编指令的即时解密，可以用来隐藏众所周知且已被检测的 shellcode（如 msfvenom），从而使内存扫描器对该特定内存页失效。 工作原理： 该技术将创建一个PAGEEXECUTEREADWRITE内存区域，用于存储加密的汇编指令。shellcode 周围会包裹一些填充字节。程序将在 shellcode 的入口点设置一个硬件断点（HWBP）。 接下来，程序将安装一个向量化异常处理程序（VEH）。该 VEH 基本上就像一个调试器，对代码进行单步执行，针对 VEH 接收到的每个SINGLE...

CVE-2026-55244

ASTEVAL (a Python expression evaluator) prior to 1.0.9 has a sandbox escape via BaseException subclasses . The FROM_PY symbol table in astutils.py exposes SystemExit, KeyboardInterrupt, GeneratorExit, and BaseException to sandboxed expressions, while run() and eval() in asteval.py only catch Exce...

CVE-2019-25733

NetShareWatcher 1.5.8.0 contains a structured exception handler buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying malicious input. Attackers can craft a payload with overwritten SEH and NSEH pointers through the Restrictions custom filter field to...

CVE-2019-25733

NetShareWatcher 1.5.8.0 contains a structured exception handler buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying malicious input. Attackers can craft a payload with overwritten SEH and NSEH pointers through the Restrictions custom filter field to...

EUVD-2019-20169

NetShareWatcher 1.5.8.0 contains a structured exception handler buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying malicious input. Attackers can craft a payload with overwritten SEH and NSEH pointers through the Restrictions custom filter field to...

PT-2026-46203

NetShareWatcher 1.5.8.0 contains a structured exception handler buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying malicious input. Attackers can craft a payload with overwritten SEH and NSEH pointers through the Restrictions custom filter field to...

Nsasoft NetShareWatcher 安全漏洞

Nsasoft NetShareWatcher is a security auditing tool developed by the US company Nsasoft. Version 1.5.8.0 of Nsasoft NetShareWatcher contains a security vulnerability. This vulnerability stems from a buffer overflow in the structured exception handler, which could allow local attackers to execute...

EUVD-2018-21953

Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by overwriting the structured exception handler. Attackers can craft a malicious input file with a 672-byte offset to overwrite the nSEH and SEH pointers, enabling code execution through...

CVE-2018-25432

Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by overwriting the structured exception handler. Attackers can craft a malicious input file with a 672-byte offset to overwrite the nSEH and SEH pointers, enabling code execution through...

CVE-2018-25427

Arm Whois 3.11 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by supplying oversized input to the IP address or domain field. Attackers can craft malicious input exceeding 658 bytes with shellcode to overwrite the structured exception...

CVE-2018-25432 Arm Whois 3.11 Buffer Overflow via ASLR Bypass

Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by overwriting the structured exception handler. Attackers can craft a malicious input file with a 672-byte offset to overwrite the nSEH and SEH pointers, enabling code execution through...

CVE-2018-25432

Arm Whois 3.11 is affected by a local buffer overflow that allows code execution via exception handler hijacking. An input file crafted with a 672-byte offset can overwrite nSEH and SEH pointers, enabling arbitrary code execution when the structured exception handler is triggered. CVSS data prese...

CVE-2018-25432 Arm Whois 3.11 Buffer Overflow via ASLR Bypass

Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by overwriting the structured exception handler. Attackers can craft a malicious input file with a 672-byte offset to overwrite the nSEH and SEH pointers, enabling code execution through...

CVE-2018-25427 Arm Whois 3.11 Buffer Overflow via SEH Overwrite

Arm Whois 3.11 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by supplying oversized input to the IP address or domain field. Attackers can craft malicious input exceeding 658 bytes with shellcode to overwrite the structured exception...

PT-2026-45623

Name of the Vulnerable Software and Affected Versions Arm Whois version 3.11 Description A buffer overflow allows local attackers to execute arbitrary code by overwriting the structured exception handler. By crafting a malicious input file with a 672-byte offset, an attacker can overwrite the nSE...

PT-2026-45618

Name of the Vulnerable Software and Affected Versions Arm Whois version 3.11 Description A stack-based buffer overflow occurs when the application processes oversized input in the IP address or domain fields. Remote attackers can provide input exceeding 658 bytes containing shellcode to overwrite...