SteganographierGUI

SteganographierGUI Hide files into MP4/MKV files Please make sure you understand what "file extension " means before watching the following tutorial. If you don't understand, first search "how to change a file extension" If it still shows as MP4 after changing the extension, that means file...

evilMP4

evilMP4 Explore CVE-2022-41741 with the Evil MP4 repository. It offers educational PoCs, and detailed documentation on securing nginx against MP4 file vulnerabilities. For legal, ethical security testing only. This repository provides tools, documentation, and examples for understanding and...

Metaphor

Metaphor Metaphor - Stagefright with ASLR bypass By Hanan Be'er from NorthBit Ltd. Link to whitepaper: https://raw.githubusercontent.com/NorthBit/Public/master/NorthBit-Metaphor.pdf Twitter: https://twitter.com/HighByte Metaphor's source code is now released! The source include a PoC that generat...

CVE-2026-0006-openapv-poc

CVE-2026-0006：libopenapv 中的堆缓冲区溢出（Android APV 编解码器） 补丁分析与复现 — Mobile Hacking Lab CVSS 9.8 严重 | 已在野外被积极利用 | 2026 年 3 月已修复 注意： 我们并非此漏洞的发现者。发现并负责任地报告 CVE-2026-0006 的功劳归功于原始研究人员。本仓库包含我们独立的补丁分析、复现及教学性文章 ，旨在帮助安全社区理解相关漏洞类别及所涉及的利用技术。 概述 CVE-2026-0006 是 libopenapv 中的一个堆缓冲区溢出漏洞，该库是三星开源的 APV（Advanced...

ssrf-sheriff

SSRF Sheriff This is an SSRF testing sheriff written in Go. It was originally created for the Uber H1-4420 2019 London Live Hacking Event, but it is now being open-sourced for other organizations to implement and contribute back to. Features Respond to any HTTP method GET, POST, PUT, DELETE, etc...

scaredycat

SCAREDYCAT! version 0.1 beta Python script to generate a malicious MP4 file and start a web server hosting a page with the embedded 'video' file on port 8080. This exploits another Stagefright vulnerability, the integer overflow vulnerability CVE-2015-3864, published by Exodus Intelligence. autho...

cve-2015-1538-1

附带的是一段Python脚本，用于生成利用‘stsc’漏洞（即CVE-2015-1538（1））的MP4文件。这是我在Stagefright库中报告的最关键的漏洞之一。此漏洞利用的预期结果是获得media用户权限下的反向shell。正如我在Black Hat和DEF CON演讲中详述的那样，该用户还拥有inet、audio、camera和mediadrm等多个组的访问权限。这些组允许攻击者在不利用额外漏洞的情况下远程拍照或监听麦克风。 该漏洞利用存在几个注意事项。首先，它并非通用利用代码，仅经测试可在单一设备型号上运行。我的目标是运行Android 4.0.4的Galaxy...

nginx:1.26 security update

1.26.3-9.4.0.1 - Require oracle-indexhtml 2:1.26.3-14 - Fixes CVE-2026-42533 2:1.26.3-13 - Fixes CVE-2026-56434 and CVE-2026-60005 2:1.26.3-12 - Resolves: RHEL-191774 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes 2:1.26.3-11 - nginx:1.26/nginx: HTTP/2: Remote Denial of Servic...

CVE-2016-3861

CVE-2016-3861 这是 Mark Brand 的 libutils 漏洞利用的扩展版本，源自 Google Project Zero 博客文章：https://googleprojectzero.blogspot.com/2016/09/return-to-libstagefright-exploiting.html 主要区别： 所有用于漏洞利用的 mp4 文件都在浏览器中动态生成 带有 'extragroom' 选项，因为某些 5-6 版本区间的 AOSP 构建需要额外的堆 grooming 这真的有效吗？ 是的，但它只能控制 PC（程序计数器），没有进一步操作...

cve-2015-1538-1

PLEASE DO NOT SHARE THIS WITH ANYONE. THIS CODE IS BEING PROVIDED TO YOU UNDER FrienNDA. PEOPLE VIOLATING THIS WILL NO LONGER BE CONSIDERED FRIENDS. Included is a python script that generates an MP4 exploiting the ‘stsc’ vulnerability otherwise known as CVE-2015-1538 1. This is one of the most...

CVE-2024-0039-Exploit

CVE-2024-0039-Exploit 説明 CVE-2024-0039の脆弱性を利用するPythonスクリプト：影響を受けるAndroidデバイスで任意のコードを実行します。 注意 : このコードは教育と創造のみを目的としており、善の側に立つためのものです、いわば！ 使用方法 必要な引数を指定してスクリプトを実行します： root@kitploit: python exploit.py --cb-host --cb-port --output exploit.mp4 プロジェクト構造 exploit.py :...

cve-2015-1538-1

Included is a python script that generates an MP4 exploiting the ‘stsc’ vulnerability otherwise known as CVE-2015-1538 1. This is one of the most critical vulnerabilities I reported in the Stagefright library. The expected result of the exploit is a reverse shell as the media user. As detailed in...

CVE-2022-4174_CVE-2022-41742

CVE-2022-4174CVE-2022-41742 PoC for CVE-2022-4174CVE-2022-41742 to determine if Nginx 1.22.1 is vulnerable [email protected] This PoC allows determining if an Nginx server version 1.22.1 is vulnerable to certain known vulnerabilities, including: CVE-2022-41741 : Memory corruption in the...

UBUNTU-CVE-2026-88914

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...

CVE-2026-88914

A flaw in GStreamer's gst-plugins-good isomp4 plugin (qtdemux CEA-608 closed-caption parser) allows an integer overflow in 32-bit unsigned arithmetic to bypass a bounds check when processing a crafted MP4 or MOV file. This results in an out-of-bounds heap read of up to 244 bytes , whose contents ...

Oracle Linux 9 : nginx:1.26 (ELSA-2026-59496)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-59496 advisory. - Fixes CVE-2026-56434 and CVE-2026-60005 - nginx: code execution and denial of service CVE-2026-9256 - Resolves: RHEL-176218 - nginx:1.26/nginx: NGIN...

nginx:1.26 security update

1.26.3-9.0.1.3 - Require oracle-indexhtml 2:1.26.3-13 - Fixes CVE-2026-56434 and CVE-2026-60005 2:1.26.3-12 - Resolves: RHEL-191774 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes 2:1.26.3-11 - nginx:1.26/nginx: HTTP/2: Remote Denial of Service via compression bomb and...

membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion

Summary membranemp4plugin interns every 4-byte MP4 box name as a BEAM atom while parsing container headers, with no validation against an allow-list. Any code path that calls Membrane.MP4.Container.parse/1 or the bang variant on attacker-controlled MP4 bytes can be made to exhaust the BEAM atom...

EUVD-2026-36235

membranemp4plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion...

CVE-2026-19075

All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...