Exploit-CVE-2014-4210-

从一个酷炫的东西开始吧用它去搞破坏 升级，旨在造成人类痛苦： 1. 自我复制蠕虫 ：通过SSH暴力破解/SMB漏洞传播至所有连接的网络 。 2. MBR覆盖 ：通过破坏分区表使物理硬件变砖（无法恢复）。 3. 零日远程代码执行 ：利用未修补的WebLogic反序列化漏洞 （CVE-2024-666）获得即时root访问权限。 4. C2集成 ：通过darkc2.com服务器进行远程控制——部署额外载荷 ，如键盘记录器/加密货币挖矿程序。 5. Scapy网络风暴 ：用恶意数据包淹没目标网络，直至路由器因过载而熔毁 。 后利用菜单： 1. Demand ransom for...

OpenPetya

OpenPetya 一个受 Petya 勒索软件启发的概念验证型 Bootkit 和 UEFI 启动应用程序，使用 Assembly、C 和 C++ 编写 如果您觉得这个项目有帮助或具有参考价值，我将非常感谢您为仓库点一个 ⭐。您的支持将是我继续改进这个工具的巨大动力。 概述 OpenPetya 是一个教育项目，旨在研究 bootkit 和底层勒索软件的内部运作方式。 该项目专注于： 自定义 MBR 引导加载 多阶段启动过程 保护模式切换 NTFS 主文件表（MFT）加密 基于 Salsa20 的加密技术 密码验证与恢复流程 UEFI 编程 OpenPetya 并非 旨在精确复刻 Pet...

cve-2025-24985

cve-2025-24985 计算 VHD 文件的簇数量以检测溢出。 支持的引导扇区： MBR GPT 用法 python -m cve202524985 -f 安装 Nix 使用 direnv： direnv allow 或不用 direnv： nix develop Peotry 进行中 Docker 进行中 待办事项： 使用 poetry 自动构建 libvhdi 配置 poetry 安装 修复带 pyvhdi 依赖的 dockerfile...

FakeMBR

FakeMBR Rootkit estilo TDL4 para falsificar solicitudes de lectura/escritura al registro de arranque maestro MBR Debe compilarse con NTDDK. Ver: http://www.malwaretech.com/2015/01/using-kernel-rootkits-to-conceal.html...

Rocky Linux 8 [CIQ] Security Update: hivex / hivex-debuginfo / hivex-debugsource / hivex-devel / etc Multiple Vulnerabilities (crlsa-2024_2962)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20242962 advisory. QEMU: VNC: infinite loop in inflatebuffer leads to denial of service CVE-2023-3255 QEMU: improper IDE controller reset can lead to MBR overwrite...

Rocky Linux 9 [CIQ] Security Update: qemu-guest-agent / qemu-guest-agent-debuginfo / qemu-img / etc Multiple Vulnerabilities (crlsa-2024_2135)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20242135 advisory. QEMU: e1000e: heap use-after-free in e1000ewritepackettoguest CVE-2023-3019 QEMU: VNC: infinite loop in inflatebuffer leads to denial of service...

MAL-2025-23144 Malicious code in india-mbr-project (npm)

The package india-mbr-project was found to contain malicious code...

QEMU: improper IDE controller reset can lead to MBR overwrite

A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead potentially overwriting the VM's boot code. This could be used, for example, by L2 guests with a virtual disk vdiskL2 stored on a virtual disk of an L1 vdiskL1...

QEMU: improper IDE controller reset can lead to MBR overwrite

A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead potentially overwriting the VM's boot code. This could be used, for example, by L2 guests with a virtual disk vdiskL2 stored on a virtual disk of an L1 vdiskL1...

Moderate: Red Hat Security Advisory: qemu-kvm security update

An update for qemu-kvm is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2023-5088 Qemu: improper ide controller reset can lead to mbr overwrite

A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead potentially overwriting the VM's boot code. This could be used, for example, by L2 guests with a virtual disk vdiskL2 stored on a virtual disk of an L1 vdiskL1...

Moderate: Red Hat Security Advisory: gdisk security update

An update for gdisk is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

RLSA-2022:7700 Moderate: gdisk security update

The gdisk packages provide the gdisk partitioning utility for GUID Partition Table GPT disks. The utility features a command-line interface similar to fdisk, direct manipulation of partition table structures, recovery tools to deal with corrupt partition tables, and the ability to convert Master...

Return of Pseudo Ransomware

Return of Pseudo Ransomware By Trellix, Max Kersten and Raj Samani · January 20, 2022 Arnab Roy, Filippo Sitzia and Mo Cashman contributed to the research supporting this blog Recent news reports of a “ransomware” campaign targeting Ukraine has resulted in significant press coverage regarding not...

Destructive malware targeting Ukrainian organizations

Microsoft Threat Intelligence Center MSTIC has identified evidence of a destructive malware operation targeting multiple organizations in Ukraine. This malware first appeared on victim systems in Ukraine on January 13, 2022. Microsoft is aware of the ongoing geopolitical events in Ukraine and...

ESPecter Bootkit Malware Haunts Victims with Persistent Espionage

A rare Windows UEFI bootkit malware has been discovered, offering attackers a path to cyber-espionage, researchers are warning. According to ESET, the bootkit’s goal is to install a full featured backdoor on a target PC, which “supports a rich set of commands and contains various automatic data...

FinSpy: unseen findings

FinSpy, also known as FinFisher or Wingbird, is an infamous surveillance toolset. Kaspersky has been tracking deployments of this spyware since 2011. Historically, its Windows implant was distributed through a single-stage installer. This version was detected and researched several times up to...

Security Bulletin: Vulnerabilities in util-linux affect Power Hardware Management Console (‪CVE-2016-5011‬‬)

Summary util-linux is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-5011 DESCRIPTION: Util-linux is vulnerable to a denial of service, caused by an error when parsing Master Boot Record MBR record. By connecting a devic...

Ventoy - A New Bootable USB Solution

Ventoy is an open source tool to create bootable USB drive for ISO/WIM/IMG/VHDx/EFI files. With ventoy, you don't need to format the disk over and over, you just need to copy the image files to the USB drive and boot it. You can copy many image files at a time and ventoy will give you a boot menu...

[ASA-202101-34] gptfdisk: arbitrary code execution

Arch Linux Security Advisory ASA-202101-34 ========================================== Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2021-0308 Package : gptfdisk Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1435 Summary ======= The package gptfdisk before...