43 matches found
DeepSleep
DeepSleep 一种针对 x64 的 Gargoyle 变体，仅使用 ROP 和 PIC 隐藏内存痕迹。 衷心感谢 @waldoirc 在他的 博客 中记录了此技术的大部分内容。 此实现的不同之处在于它不使用任何 APC，并且完全以 PIC 形式实现。 描述 我创建此工具是为了更好地理解如何在 x64 上使用类似 Gargoyle 的技术规避内存痕迹。 其思路是设置一个 ROP 链，依次调用 VirtualProtect - Sleep - VirtualProtect，以便在 Sleep 期间将自己的页面标记为 N/A 。 与 Gargoyle 及其他类似实现不同，我完全依赖...
volatility-plugins
https://www.countercept.com/blog/hunting-for-gargoyle-memory-scanning-evasion/...
dotnet-gargoyle
dotnet-gargoyle Un equivalente espiritual en .NET a la técnica de evasión de escaneo de memoria Gargoyle https://www.countercept.com/blog/gargoyle-memory-scanning-evasion-for-net/...
CVE-2015-10145
Gargoyle router management utility versions 1.5.x contain an authenticated OS command execution vulnerability in /utility/runcommands.sh. The application fails to properly restrict or validate input supplied via the 'commands' parameter, allowing an authenticated attacker to execute arbitrary she...
CVE-2015-10145
Gargoyle router management utility versions 1.5.x contain an authenticated OS command execution vulnerability in /utility/runcommands.sh. The application fails to properly restrict or validate input supplied via the 'commands' parameter, allowing an authenticated attacker to execute arbitrary she...
CVE-2015-10145 Gargoyle 1.5.x Authenticated OS Command Execution via run_commands.sh
Gargoyle router management utility versions 1.5.x contain an authenticated OS command execution vulnerability in /utility/runcommands.sh. The application fails to properly restrict or validate input supplied via the 'commands' parameter, allowing an authenticated attacker to execute arbitrary she...
CVE-2015-10145
Gargoyle router management utility versions 1.5.x expose an authenticated OS command execution vulnerability in /utility/run_commands.sh due to improper validation of the commands parameter. An authenticated attacker can execute arbitrary shell commands on the device, potentially leading to full ...
EUVD-2025-206059
Gargoyle router management utility versions 1.5.x contain an authenticated OS command execution vulnerability in /utility/runcommands.sh. The application fails to properly restrict or validate input supplied via the 'commands' parameter, allowing an authenticated attacker to execute arbitrary she...
CVE-2015-10145
Gargoyle router management utility versions 1.5.x contain an authenticated OS command execution vulnerability in /utility/runcommands.sh. The application fails to properly restrict or validate input supplied via the 'commands' parameter, allowing an authenticated attacker to execute arbitrary she...
CVE-2015-10145 Gargoyle 1.5.x Authenticated OS Command Execution via run_commands.sh
Gargoyle router management utility versions 1.5.x contain an authenticated OS command execution vulnerability in /utility/runcommands.sh. The application fails to properly restrict or validate input supplied via the 'commands' parameter, allowing an authenticated attacker to execute arbitrary she...
PT-2025-54455
Name of the Vulnerable Software and Affected Versions Gargoyle router management utility versions 1.5.x Description The application does not properly restrict or validate input provided through the commands parameter, leading to authenticated OS command execution. This occurs in the /utility/run...
Gargoyle Router Management Utility 安全漏洞
Gargoyle Router Management Utility is a third-party router firmware from Gargoyle. A security vulnerability exists in Gargoyle Router Management Utility version 1.5.x, which stems from a restricted or insufficient validation of the commands parameter input, which could allow an authenticated...
VulnCheck KEV: CVE-2015-10145
Gargoyle router management utility versions 1.5.x contain an authenticated OS command execution vulnerability in /utility/runcommands.sh. The application fails to properly restrict or validate input supplied via the 'commands' parameter, allowing an authenticated attacker to execute arbitrary she...
CVE-2015-10145: Improper Neutralization of Special Elements used in an OS Command
Gargoyle router management utility versions 1.5.x contain an authenticated OS command execution vulnerability in /utility/runcommands.sh. The application fails to properly restrict or validate input supplied via the 'commands' parameter, allowing an authenticated attacker to execute arbitrary she...
EUVD-2010-3357
Malware in sbrugna...
EUVD-2021-10365
Malware in sbrugna...
CVE-2021-23270
In Gargoyle OS 1.12.0, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a...
CVE-2010-3359
If LDLIBRARYPATH is undefined in gargoyle-free before 2009-08-25, the variable will point to the current directory. This can allow a local user to trick another user into running gargoyle in a directory with a cracked libgarglk.so and gain access to the user's account...
RustChain - Hide Memory Artifacts Using ROP And Hardware Breakpoints
This tool is a simple PoC of how to hide memory artifacts using a ROP chain in combination with hardware breakpoints. The ROP chain will change the main module memory page's protections to N/A while sleeping i.e. when the function Sleep is called. For more detailed information about this memory...
SUSE CVE-2010-3359
If LDLIBRARYPATH is undefined in gargoyle-free before 2009-08-25, the variable will point to the current directory. This can allow a local user to trick another user into running gargoyle in a directory with a cracked libgarglk.so and gain access to the user's account...