rndis-co

RNDIS-CO Summary The RNDIS USB Gadget may be exploited to dump contents of kernel memory space via packet filter update mechanism. Description The RNDISMSGSET usb control transfer request handler - rndissetresponse calls genndissetresp passing a buffer pointer offset by BufOffset + 8. The BufOffs...

dismember

🔪 Dismember Dismember is a command-line toolkit for Linux that can be used to scan the memory of all processes or particular ones for common secrets and custom regular expressions, among other things. It will eventually become a full /proc toolkit. Using the grep command, it can match a regular...

heartbleed-proof-of-concept

Heartbleed CVE-2014-0160 Setup You will require docker in order to perform the setup. The exploit, dynamically generates the random bytes from the Client Hello message, therefore you will need to link the library when building the executable. The required package to be installed, in order to link...

blindsight

blindsight "There's no such things as survival of the fittest. Survival of the most adequate, maybe. It doesn't matter whether a solution's optimal. All that matters is whether it beats the alternative." -- Peter Watts, Blindsight 2006 Red teaming tool to dump LSASS memory, bypassing basic...

zettelforge

ZettelForge The only agentic memory system built for cyber threat intelligence. When a senior analyst leaves, two or three years of context walks out with them — customer environments, prior investigations, actor TTPs, false-positive patterns, every hard-won "wait, we've seen this before."...

CVE-2026-86950

🛡️ CVE-2026-86950 — CoreGraphics Security Research 🔬 Defensive Security Research • Vulnerability Analysis • Detection 📌 Overview CVE-2026-86950 is a high-severity vulnerability affecting Apple's CoreGraphics component. The vulnerability is classified as an out-of-bounds write CWE-787 and can...

dyen

dyen dyen loads a Mach-O dylib in memory using stock macOS Python and calls an exported entry point without dlopen on that dylib. The aim is that the image is never a standalone file on the target and is never registered with dyld. by cenobyte [email protected] 2026...

CVE-2023-4863

CVE-2023-4863 checkout webp git clone https://chromium.googlesource.com/webm/libwebp/ webptest cd webptest/ checkout vulnerable version git checkout 7ba44f80f3b94fc0138db159afea770ef06532a0 enable AddressSanitizer sed -i 's/^EXTRAFLAGS=./& -fsanitize=address/' makefile.unix build webp make -f...

CVE-2026-20687-AppleJPEGDriver-UAF

CVE-2026-20687 — AppleJPEGDriver startDecoder Timeout UAF CVE-2026-20687 · Enfilade · enfilade.io Component: Kernel Impact: An app may be able to cause unexpected system termination or write kernel memory. Description: A use after free issue was addressed with improved memory management. —Apple...

heartbleed-PoC

Heartbleed PoC A sample example of the Heartbleed attack using the server https://www.cloudflarechallenge.com/ made for trying this attack. First, the two best explanations I read on the subject : http://www.seancassidy.me/diagnosis-of-the-openssl-heartbleed-bug.html http://xkcd.com/1354/ Exploit...

CVE-2021-21551

CVE-2021-21551 Simple PoC for exploiting CVE-2021-21551 for LPE by spawning system cmd. https://vulners.com/cve/CVE-2021-21551 An issue was discovered in signed dell windows driver dbutil23.sys which may lead to compromisation of whole local system. Driver's ioctl dispatch routine lacks of...

TinyLoad

TinyLoad v7.4 - PE packer and crypter for windows TinyLoad is an pe crypter/packer for x64 executables it packs an input exe with varying protection layers to prevent it from being reverse engineered. Its 1 single .cpp file and does not have any external dependencies. how it works TinyLoad append...

Chisel-Strike

Chisel-Strike A .NET XOR encrypted cobalt strike aggressor implementation for chisel to utilize faster proxy and advanced socks5 capabilities. Why write this? In my experience I found socks4/socks4a proxies quite slow in comparison to its socks5 counterparts and a lack of implementation of socks5...

Wallbreak

Wallbreak Download as APK This app demonstrates two high severity permanent denial-of-service vulnerabilities in Android's WallpaperManagerService that I discovered: CVE-2021-39670 and CVE-2021-39690. After running either exploit, the device will keep repeatedly crashing and rebooting. Write-up...

BlueKeep

Bluekeep PoC This repo contains research concerning CVE-2019-0708. Bluekeep or CVE-2019-0708 is an RCE exploit that effects the following versions of Windows systems: Windows 2003 Windows XP Windows Vista Windows 7 Windows Server 2008 Windows Server 2008 R2 The vulnerability occurs during...

CVE-2024-38063-POC

IPv6 Vulnerability Packet Sender for Memory Corruption CVE-2024-38063 This Python script is designed to send crafted packets to trigger potential memory corruption vulnerabilities CVE-2024-38063. It utilizes the Scapy library to create and send IPv6 packets, optionally using specified MAC...

CVE-2026-116775

pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to communicate with a running Pageant instance. From 0.2.0 until 0.2.5, PageantStream::new in pageant/src/wmmessage.rs trusts a peer-controlled four-byte length prefix and buffers until len + 4...

PixelCode-Attack

Malicious PixelCode Delivery Technique Malicious PixelCode is a security research project that demonstrates a covert technique for encoding executable files into pixel data and storing them inside images or videos. A lightweight loader retrieves the media file, reconstructs the original binary, a...

allthingsida

Operating system MS Windows PEB/LDRDATATABLEENTRY enumeration scripts PEB/TEB structures x64 PEB/TEB structures x86...

CVE-2023-30367-mRemoteNG-password-dumper

mRemoteNG = v1.77.3.1784-NB Password Dumper CVE-2023-30367 Multi-Remote Next Generation Connection Manager mRemoteNG is free software that enables users to store and manage multi-protocol connection configurations to remotely connect to systems. mRemoteNG configuration files can be stored in an...