SharpKiller

SharpKiller 由 @ZeroMemoryEx 编写、移植到 .NET Framework 4.8 的永久性 AMSI 绕过工具 AMSI-Killer。 需要额外混淆 https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=VirTool:MSIL/SharpKiller.A&ThreatID=2147895059 新增集成功能： x - 每 0.5 秒实时扫描新的 PowerShell 进程 - 自动修补新的 PowerShell 实例 生成解决方案...

DeadDialect

DeadDialect すべてのブートが異なる言語を話す。昨日のバイナリは今日の死んだコードである。 セッション固有のRISC-V ISA再マッピングシステム。システムが起動するたびに、命令セットの新しい暗号学的置換を生成する。あるセッション用にコンパイルされたバイナリは、次のセッションでは暗号学的に拒否される。再起動後も生存するマルウェアは実行できない——死んだ方言を話すからだ。 アイデア 標準ISAは固定された契約である。すべてのプログラム、すべてのライブラリ、すべてのマルウェアは、0x13が何を意味するか、syscall...

shellme

shellme 因为有时候你只是需要快速获取 shellcode 和操作码。这本质上只是将一些 nasm/objdump 调用封装成一个简洁的脚本。 root@kitploit: bryan@devbox:/shellme$ python shellme.py usage: shellme.py -h -n FILE -o OUTPUT -i INSTRUCTION -a ARCH optional arguments: -h, --help show this help message and exit -n FILE nasm or object file -o OUTPUT...

shellnoob

ShellNoob Writing shellcodes has always been super fun, but some parts are extremely boring and error prone. Focus only on the fun part, and use ShellNoob! For a quick overview, check the slides for the Black Hat Arsenal talk: link Want to contribute? Feature request? Bug report? Swears? All...

CVE-2020-25478--ASUS-RT-AC87U-TFTP-is-vulnerable-to-Denial-of-Service-DoS-attack

ASUS-RT-AC87U-TFTP 存在拒绝服务（DoS）攻击漏洞 CVE-2020-25478 - ASUS RT-AC87U TFTP 存在拒绝服务（DoS）攻击漏洞 1. 受影响产品及版本 ASUS RT-AC87U 3.0.0.4.38251640 2. 问题类型 该问题主要与 CWE-20 相关。当向 ASUS RT-AC87U 中运行的 TFTP 服务发送无效操作码（opcode）时，该服务存在拒绝服务（DoS）攻击漏洞。以下 Python 代码片段用于测试该漏洞： root@kitploit: import socket import sys tftpd =...

sandsifter

s a n d s i f t e r : the x86 processor fuzzer Overview The sandsifter audits x86 processors for hidden instructions and hardware bugs, by systematically generating machine code to search through a processor's instruction set, and monitoring execution for anomalies. Sandsifter has uncovered secre...

Amsi-Killer

Lifetime AMSI bypass Opcode Scan we get the exact address of the jump instruction by searching for the first byte of each instruction this technique is effective even in the face of updates or modifications to the target data set. for example : | 48:85D2 | test rdx, rdx | | 74 3F | je...

NashaVM

NashaVM - ネイティブSharp仮想マシン Nashaは.NETファイル用の仮想マシンで、そのランタイムはC++/CLIで作られています。 インストール root@kitploit: git clone https://github.com/Mrakovic-ORG/NashaVM --recurse cd NashaVM\NashaVM nuget restore msbuild 依存関係 dnlib .NET Framework Visual C++ Redistrutable よくある質問 このプロジェクトの目的は？...

CVE-2026-31911

A flaw was found in libpcap. A local attacker could provide a crafted filter program containing an invalid Berkeley Packet Filter BPF opcode. This could cause the operating system OS process using libpcap to terminate, leading to a Denial of Service DoS...

Linux Distros Unpatched Vulnerability : CVE-2026-19204

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and...

DEBIAN-CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

UBUNTU-CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

CVE-2026-19204

Eclipse Jetty is vulnerable in its WebSocket component when auto-fragmentation is enabled. A remote, unauthenticated client can send a WebSocket frame with an unknown opcode and a very large declared payload length. Because unknown opcodes bypass the normal maximum frame size handling and payload...

CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

EUVD-2026-72335

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

PT-2026-86673

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...