aDLL

aDLL - Adventure of Dinamic Lynk Library aDLLは、DLL Hijackingの脆弱性を自動的に発見することに特化したバイナリ解析ツールです。このツールは、メモリにロードされたバイナリのイメージを解析し、ロード時に読み込まれるDLLを検索します。また、Microsoft Detoursライブラリを使用してLoadLibrary/LoadLibraryEx関数の呼び出しをフックし、実行時に読み込まれるDLLを解析します。目的は、実行可能ファイルが検索されるフォルダ内で見つからないDLLのリストを取得することです。 はじめに...

obex

Obex - Bloqueo de DLL Obex es una herramienta/técnica de PoC que se puede utilizar para evitar que módulos no deseados p. ej., EDR o librerías de monitorización se carguen en un proceso recién iniciado durante la inicialización del proceso o en tiempo de ejecución. Características Inicia cualquie...

pe-bear

PE-bear PE-bear is a multiplatform reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files...

doublepulsar-usermode-injector

作者：Matt Hillman（[email protected] - @sp1nl0ck） 公司：Countercept（@countercept） 网站：https://countercept.com 一个利用 DOUBLEPULSAR 载荷中的用户态 shellcode，将任意 DLL 反射式加载到另一个进程中的实用工具，用于测试检测技术或进行其他安全研究。 背景 Shadow Brokers 泄露的 DOUBLEPULSAR 载荷最初在内核态运行，并通过异步过程调用（APC）将 DLL 反射式加载到用户态进程中。DLL 的实际加载发生在用户态，本工具利用该用户态...

CdpSvcLPE

CdpSvcLPE 通过 CdpSvc 服务实现 Windows 本地权限提升（可写 SYSTEM 路径 DLL 劫持） 简短描述： Connected Devices Platform Service（简称 CDPSvc）是一种以 NT AUTHORITY\LOCAL SERVICE 身份运行的服务，它在启动时通过调用 LoadLibrary 尝试加载缺失的 cdpsgshims.dll DLL，但未指定其绝对路径。因此，可以在 DLL 搜索顺序目录中劫持该 DLL；如果我们在一个可写的 SYSTEM 路径（如 C:\python27）中劫持该 DLL，就能以 NT...

CVE-2026-38972

Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibraryL"MSFTEDIT.DLL" with a bare DLL name, which allows a local attacker to place a malicious MSFTEDIT.DLL in the application directory or...

CVE-2026-38972

Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibraryL"MSFTEDIT.DLL" with a bare DLL name, which allows a local attacker to place a malicious MSFTEDIT.DLL in the application directory or...

CVE-2026-38972

Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibraryL"MSFTEDIT.DLL" with a bare DLL name, which allows a local attacker to place a malicious MSFTEDIT.DLL in the application directory or...

EUVD-2019-19004

Malware in sbrugna...

EUVD-2016-4967

Malware in sbrugna...

EUVD-2015-1888

Malware in sbrugna...

EUVD-2018-12467

Malware in sbrugna...

LightsOut - Generate An Obfuscated DLL That Will Disable AMSI And ETW

LightsOut will generate an obfuscated DLL that will disable AMSI & ETW while trying to evade AV. This is done by randomizing all WinAPI functions used, xor encoding strings, and utilizing basic sandbox checks. Mingw-w64 is used to compile the obfuscated C code into a DLL that can be loaded into a...

The vulnerability of the LoadLibrary function in the cross-platform framework for developing Qt software allows a perpetrator to gain access to protected information.

The vulnerability of the LoadLibrary function in the cross-platform framework for developing Qt software relates to the possibility of bypassing the directory. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to protected information...

TFTP Fetch, Windows x64 LoadLibrary Path

Fetch and execute an x64 payload from a TFTP server. Load an arbitrary x64 library path Module Options msf use payload/cmd/windows/tftp/x64/loadlibrary msf payloadloadlibrary show actions ...actions... msf payloadloadlibrary set ACTION msf payloadloadlibrary show options ...show and set options...

HTTP Fetch, Windows x64 LoadLibrary Path

Fetch and execute an x64 payload from an HTTP server. Load an arbitrary x64 library path Module Options msf use payload/cmd/windows/http/x64/loadlibrary msf payloadloadlibrary show actions ...actions... msf payloadloadlibrary set ACTION msf payloadloadlibrary show options ...show and set options...

GO-2022-0220 DLL injection on Windows in runtime and syscall

Go on Windows misused certain LoadLibrary functionality, leading to DLL injection...

Duplicate Advisory: Kerberos for NodeJS allows DLL Injection

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m2mx-rfpw-jghv. This link is maintained to preserve external references. Original Description The kerberos package before 1.0.0 for Node.js allows arbitrary code execution and privilege escalation via injection ...

GHSA-F478-XWV9-P93Q Duplicate Advisory: Kerberos for NodeJS allows DLL Injection

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m2mx-rfpw-jghv. This link is maintained to preserve external references. Original Description The kerberos package before 1.0.0 for Node.js allows arbitrary code execution and privilege escalation via injection ...

Powershell Exec, Windows x64 LoadLibrary Path

Execute an x64 payload from a command via PowerShell. Load an arbitrary x64 library path Module Options msf use payload/cmd/windows/powershell/x64/loadlibrary msf payloadloadlibrary show actions ...actions... msf payloadloadlibrary set ACTION msf payloadloadlibrary show options ...show and set...