mtproto-dissector

Telegram 协议解析器 这是一个 Wireshark 解析器，可帮助你了解周围的 Telegram 流量。 它根据 MTProto 2.0 协议 解析所看到的 Telegram 数据包。 功能 支持 传输协议：Abridged、Full、Intermediate、HTTP 支持去混淆 支持 TCP 重组 支持解密（使用给定的 auth key） 解析 TL 语言 RPC 载荷 限制 仅支持 MTProto 2.0（因此不适用于 2017 年之前的客户端） 尚不支持 WebSocket/Padded intermediate/UDP 传输协议 TL 语言 尚未 100%...

Salat-Stealer-Telegram-Proxy-Decoy-C2-Analysis

1. Telegram 代理诱饵 – 伪装与规避 执行后，Salat Stealer 会显示一个功能完整的 Telegram Proxy 界面。该诱饵作为伪装，诱骗用户认为他们正在运行一个合法的代理应用程序，而恶意软件则在后台执行其恶意操作。 关键观察： 界面： 该窗口模仿合法的 Telegram Proxy 客户端（proxy.telegram.org）。 端口： 使用 443 端口（标准 HTTPS 端口）以混入正常流量。 协议： 显示 MTProto 2.0（Telegram 的协议）以显得真实。 行为： 点击“Connect”会建立连接，但恶意软件的载荷已在后台激活。 为何重要：...

GHSA-WHMM-QJ9R-WVR2 td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

Impact A remote, unauthenticated attacker can cause excessive memory allocation and resulting CPU / GC pressure, potentially OOM termination by sending a crafted unencrypted MTProto packet. proto.UnencryptedMessage.Decode read an attacker-controlled 32-bit dataLen field and immediately allocated ...

td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

Impact A remote, unauthenticated attacker can cause excessive memory allocation and resulting CPU / GC pressure, potentially OOM termination by sending a crafted unencrypted MTProto packet. proto.UnencryptedMessage.Decode read an attacker-controlled 32-bit dataLen field and immediately allocated ...

CVE-2026-54638 td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencryptedmessage.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated makebyte, dataLen before checking the remaining buffer, allowing...

PT-2026-65618

Name of the Vulnerable Software and Affected Versions gotd/td versions prior to 0.145.1 Description A remote unauthenticated attacker can cause a denial of service by sending a crafted unencrypted MTProto packet. The Decode function in proto.UnencryptedMessage reads an attacker-controlled 32-bit...

CVE-2023-45312

In the mtprotoproxy aka MTProto proxy component through 0.7.2 for Erlang, a low-privileged remote attacker can access an improperly secured default installation without authenticating and achieve remote command execution ability...

EUVD-2023-2682

Malicious code in bioql PyPI...

GHSA-738Q-MC72-2Q22 MTProto proxy remote code execution vulnerability

In the mtprotoproxy aka MTProto proxy component through 0.7.2 for Erlang, a low-privileged remote attacker can access an improperly secured default installation without authenticating and achieve remote command execution ability...

MTProto proxy remote code execution vulnerability

In the mtprotoproxy aka MTProto proxy component through 0.7.2 for Erlang, a low-privileged remote attacker can access an improperly secured default installation without authenticating and achieve remote command execution ability...

CVE-2023-45312

In the mtprotoproxy aka MTProto proxy component through 0.7.2 for Erlang, a low-privileged remote attacker can access an improperly secured default installation without authenticating and achieve remote command execution ability...

Command injection

In the mtprotoproxy aka MTProto proxy component through 0.7.2 for Erlang, a low-privileged remote attacker can access an improperly secured default installation without authenticating and achieve remote command execution ability...

PT-2023-29493 · Unknown · Mtproto Proxy

Name of the Vulnerable Software and Affected Versions: mtproto proxy versions through 0.7.2 Description: A low-privileged remote attacker can access an improperly secured default installation without authenticating and achieve remote command execution ability. Recommendations: For versions throug...

CVE-2023-45312

In the mtprotoproxy aka MTProto proxy component through 0.7.2 for Erlang, a low-privileged remote attacker can access an improperly secured default installation without authenticating and achieve remote command execution ability...

CVE-2023-45312

The CVE-2023-45312 issue affects the mtproto_proxy (MTProto proxy) component for Erlang up to version 0.7.2, where a low-privileged remote attacker can access a default installation without authentication and achieve remote command execution. Public disclosures in Red Hat, GHSA, OSV, CVE lists co...

The Most Backdoor-Looking Bug I’ve Ever Seen

This is the story of a bug that was discovered and fixed in Telegrams self-rolled cryptographic protocol about seven years ago. The bug didnt get any press, and no one seems to know about it, probably because it was only published in Russian. To this day, its the most backdoor-looking bug Ive eve...