asminject

asminject.py asminject.py 是 David Buchanan 的 dlinject 项目 的一个大幅修改版分支。它通过访问 /proc//mem 而不是通过 ptrace 附加，将任意汇编（或预编译二进制）有效载荷直接注入 x86-64、x86 和 ARM32 Linux 进程。可用于篡改受信任的进程、某些后渗透场景、从进程内存中恢复内容，以及绕过某些安全控制。只要你在主机上拥有 root 权限，就可以从容器外部注入容器化进程。 你也可以在 Bishop Fox 工具页面上阅读更多关于 asminject.py 及其起源的信息，包括 一篇详细阐述启发该工具的写作。...

Next.js-RCE-Scanner-BurpSuite-Extension-

CVE-2025-55182 Next.js RCE Burp 扩展插件 功能 被动扫描 : 自动检测所有经过 Burp 的 Next.js 站点 内存码注入 v2.2 New! 右键点击目标请求，选择 注入蚁剑内存码 AntSword，支持 GET 和 POST 两种类型的内存码。 连接地址 : http://target/qaz 连接密码 : nb 编码器 : default 无需特定编码器 注入成功后，可以直接使用蚁剑连接该地址进行管理。 漏洞检测逻辑 Echo 方式 : 发送 echo random 并检查响应，速度快，无外连。 DNSLog 方式 : 使用 Burp...

ModuleShifting

ModuleShifting 本工具已在 2023 x33fcon 演讲：“提升内存注入技术的隐蔽性” 视频 博客 上展示。 这是什么 ModuleShifting 是 Module Stomping 和 Module Overloading 注入技术的更隐蔽变体。它实际上是用 Python ctypes 实现的，因此可以通过 Python 解释器和 Pyramid 完全在内存中执行，从而避免使用编译加载器。 该技术可与 PE 或 shellcode 载荷一起使用，然而，更隐蔽的变体适用于那些需要在功能上独立于 shellcode 所加载的最终载荷 的 shellcode 载荷。...

KittyStager

KittyStager KittyStager è un C2 di stage 0 composto da un'API, un client e un malware. L'API è responsabile della consegna di task di base e shellcode da iniettare in memoria da parte del malware. Il client si connette all'API e consente l'interazione con il malware creando task. L'obiettivo di...

Insanity-Framework

Insanity-Framework QUESTO PROGETTO È ORA CHIUSO - SENTITI LIBERO DI CONTINUARLO Copyright 2017 Insanity Framework IF 2.0 FINE Scritto da: Alisson Moretto - 4w4k3 Ringraziamenti speciali a Thomas Perkins - Ekultek Insanity Payload consiste nel crittografare il tuo codice e decrittografarlo in...

r77-rootkit

r77 Rootkit Fileless ring 3 rootkit r77 is a ring 3 rootkit that hides everything: Files, directories Processes & CPU/GPU usage Registry keys & values Services TCP & UDP connections Junctions, named pipes, scheduled tasks Hiding by prefix Everything that starts with "$77" is hidden. Configuration...

memhunter

Memhunter Caccia automatizzata al malware residente in memoria su larga scala Questo progetto è IN LAVORAZIONE. Sono previste modifiche alle funzionalità e rilasci binari nelle prossime settimane. Panoramica Memhunter è uno strumento sensore per endpoint specializzato nel rilevamento di malware...

meterssh

Tool Name: MeterSSH Written by: David Kennedy Company: TrustedSec Website: https://www.trustedsec.com Twitter: @TrustedSec, @HackingDave MeterSSH is a way to take shellcode, inject it into memory then tunnel whatever port you want to over SSH to mask any type of communications as a normal SSH...

Suspected Chinese-Speaking Hackers Target Central Asian Governments With OctLurk and SilkLurk

A Chinese-speaking threat actor is suspected to be behind a fresh wave of cyber attacks targeting government organizations mainly located in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic, since January 2025. These targeted...

New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email

Give an AI assistant a memory and access to your inbox, and you hand an attacker a way to rewrite what it thinks it knows about you. A single email can trick that agent into saving a false "fact" about the user, hide the change, and quietly steer its answers in later sessions. When it works, the...

CVE-2026-10223

A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. This affects the function scanmemorycontent of the file tools/memorytool.py. This manipulation causes injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used f...

Persona Attack: Incremental Memory Injection Jailbreak Attack against Large Language Models

As Large Language Models evolve for user convenience, vulnerability to jailbreak attacks continues to be reported despite ongoing efforts in safety training. Traditional jailbreak techniques typically focus on a single prompt injection, neglecting the models' ability to remember the flow of...

FreeBSD -- Heap overflow in FUSE_LISTXATTR

Problem Description: When a fusefs file system implements extended attributes, the kernel may send a FUSELISTXATTR message to the userspace daemon to retrieve the list of extended attributes for a given file. The FUSE protocol requires the daemon to return a packed list of NUL-terminated strings...

CVE-2026-7647

The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybeunserialize function on the attacker-controlled 'args' POST parameter within the wppbrequestuserspinsactioncallback AJAX handler, whi...

DEAD#VAX Malware Campaign Deploys AsyncRAT via IPFS-Hosted VHD Phishing Files

Threat hunters have disclosed details of a new, stealthy malware campaign dubbed DEADVAX that employs a mix of "disciplined tradecraft and clever abuse of legitimate system features" to bypass traditional detection mechanisms and deploy a remote access trojan RAT known as AsyncRAT. "The attack...

Evasive Panda APT poisons DNS requests to deliver MgBot

Introduction The Evasive Panda APT group also known as Bronze Highland, Daggerfly, and StormBamboo has been active since 2012, targeting multiple industries with sophisticated, evolving tactics. Our latest research June 2025 reveals that the attackers conducted highly-targeted campaigns, which...

New ChatGPT Vulnerabilities Let Hackers Steal Data, Hijack Memory

Seven vulnerabilities in ChatGPT including GPT-5 allow attackers to use '0-click' and 'memory injection' to bypass safety features and persistently steal private user data and chat history. Tenable Research exposes the flaws...

New ChatGPT Atlas Browser Exploit Lets Attackers Plant Persistent Hidden Commands

Cybersecurity researchers have discovered a new vulnerability in OpenAI's ChatGPT Atlas web browser that could allow malicious actors to inject nefarious instructions into the artificial intelligence AI-powered assistant's memory and run arbitrary code. "This exploit can allow attackers to infect...

Chinese APT Deploys EggStreme Fileless Malware to Breach Philippine Military Systems

An advanced persistent threat APT group from China has been attributed to the compromise of a Philippines-based military company using a previously undocumented fileless malware framework called EggStreme. "This multi-stage toolset achieves persistent, low-profile espionage by injecting malicious...

PT-2025-34757 · Macvim · Macvim

Name of the Vulnerable Software and Affected Versions: MacVim affected versions not specified Description: MacVim’s configuration on macOS, specifically the presence of the “com.apple.security.get-task-allow” entitlement, allows local attackers with unprivileged access to attach a debugger, read ...