r77-rootkit

r77 Rootkit Fileless ring 3 rootkit r77 is a ring 3 rootkit that hides everything: Files, directories Processes & CPU/GPU usage Registry keys & values Services TCP & UDP connections Junctions, named pipes, scheduled tasks Hiding by prefix Everything that starts with "$77" is hidden. Configuration...

pe-sieve

Introduzione PE-sieve è uno strumento che aiuta a rilevare malware in esecuzione sul sistema, nonché a raccogliere il materiale potenzialmente malevolo per ulteriori analisi. Riconosce e scarica una varietà di impianti all'interno del processo scansionato: PE sostituiti/iniettati, shellcode, hook...

CVE-2023-30367-mRemoteNG-password-dumper

mRemoteNG = v1.77.3.1784-NB Passwort-Dumper CVE-2023-30367 Multi-Remote Next Generation Connection Manager mRemoteNG ist eine freie Software, die es Benutzern ermöglicht, Multi-Protokoll-Verbindungskonfigurationen zu speichern und zu verwalten, um sich remote mit Systemen zu verbinden...

dyen

dyen dyen carica una dylib Mach-O in memoria usando la Python stock di macOS e chiama un entry point esportato senza dlopen su quella dylib. L'obiettivo è che l'immagine non sia mai un file standalone sul target e non venga mai registrata con dyld. di cenobyte [email protected] 2026...

execute-assembly-pico

Execute Assembly PICO Un PICO per Crystal Palace che implementa l'hosting nativo del CLR per eseguire un assembly .NET aggiunto in memoria, usando la stessa tecnica del generatore di shellcode donut. Questo ti permette di caricare strumenti .NET come Rubeus o Seatbelt da codice indipendente dalla...

elfloader

Summary elfloader is a super simple loader for ELF files that generates a flat in-memory representation of the ELF. Pair this with Rust and now you can write your shellcode in a proper, safe, high-level language. Any target that LLVM can target can be used, including custom target specifications...

CVE-2022-37017

CVE-2022-37017 Authentifizierungsumgehung für das Benutzeroberflächen-Passwort von Symantec Endpoint Protection 14.3.5351 Client Symantec Endpoint Protection ermöglicht das Einrichten eines Passwortschutzes für die Benutzeroberfläche, um Konfigurationsänderungen zu verhindern. Diese Passwortprüfu...

foolav

foolav Executable compiled with this code is useful during penetration tests where there is a need to execute some payload meterpreter maybe? while being certain that it will not be detected by antivirus software. The only requirement is to be able to upload two files: binary executable and paylo...

MiniPlasma-Runner

MiniPlasma-Runner Versione modificata di Nightmare-Eclipse/MiniPlasma CVE-2020-17103 adattata per uso C2. Il PoC originale funziona solo da disco. Questa versione viene eseguita interamente in memoria tramite execute-assembly, con un approccio binario suddiviso per evitare il rilevamento...

malasada

malasada Donut per Linux, converte un oggetto condiviso ELF di Linux .so in un blob .bin position-independent che può essere eseguito direttamente dalla memoria ad esempio, copiandolo in una regione mmap'd e saltando ad esso come puntatore a funzione. Questo progetto evita intenzionalmente memfd...

hollows_hunter

hollowshunter...

ShellcodeFluctuation

Shellcode Fluctuation PoC Una implementazione PoC per un'altra tecnica di evasione in-memory che cifra e decifra ciclicamente il contenuto dello shellcode per farlo fluttuare tra protezioni di memoria RW o NoAccess e RX. Quando il nostro shellcode risiede in pagine di memoria RW o NoAccess, scann...

wslink-vm-analyzer

WslinkVMAnalyzer WslinkVMAnalyzer ist ein Tool, das in erster Linie entwickelt wurde, um die Analyse von Wslink zu erleichtern, einem einzigartigen Loader, der als Server läuft und empfangene Module im Arbeitsspeicher ausführt. Dieses Tool verwendet Miasm, ein Open-Source-Framework, das eine...

MoreImpacketExamples

MoreImpacketExamples Este repositório contém alguns scripts curtos em Python criados usando a biblioteca Impacket. O objetivo principal deste projeto é ajudar a mim e a outras pessoas que desejam fazer a transição de usar os exemplos fornecidos do impacket para modificar/criar seus próprios...

FilelessPELoader

FilelessPELoader Carica un PE remoto crittografato AES in memoria, lo decritta e lo esegue Utilizzo : Riferimenti : https://github.com/aplyc1a/PEMemoryLoader?fbclid=IwAR2-VAQo8pJU-tdbSENjhDBdDGi5tyzrnW1S3D9BPAYR6C6-RK4hsEDjDGk Requisiti 1. hashlib 2. pycryptodome 3. pycryptodomex...

CVE-2026-74566

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring key-chunk byte order agree with keyringdiffobjects keyringgetkeychunk loads description bytes into the index chunk low address first, while keyringdiffobjects numbers the first differing bit from the low end an...

GHSA-47PJ-3JCM-6WHG LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

Summary The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string "memories", "alice" becomes memories.alice and scoped reads by matching that string with LIKE '%'. Because LIKE has no notion of the . separator, a scoped search or listnamespaces also matched sibling...

CVE-2026-15337

A flaw was found in Django. A remote attacker could trigger a denial-of-service DoS condition by sending many distinct, very long language codes to the django.utils.translation.checkforlanguage function. These codes are stored in an in-memory cache, leading to excessive memory consumption. While...

CVE-2026-15337 Potential denial-of-service vulnerability in check_for_language()

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...

CVE-2026-15337

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...