Metabase-Pre-Auth-RCE-POC

CVE-2023-38646 — Metabase Remote Code Execution RCE Proof-of-Concept Overview This repository documents a Proof-of-Concept PoC security research project analysing CVE-2023-38646 , a critical pre-authentication Remote Code Execution RCE vulnerability affecting vulnerable versions of Metabase. The...

-CVE-2023-43340-Evolution-Reflected-XSS---Installation-Admin-Options

Evolution CMS Reflected XSS v3.2.3 Author: Sergio Description: Multiple Cross-site scripting XSS reflected vulnerabilities in the evolution v.3.2.3 installation process Admin options allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the cmsadmin,...

process-injection-playground

Linux Process Injection Playground A comprehensive collection of process injection techniques for Linux, demonstrating various methods of injecting code into running processes. These examples are intended for educational purposes, security research, and understanding low-level Linux process...

keepass-exfil-forensics

KeePass Memory Exfiltration — Network Forensics Investigation Recovers exfiltrated data from PCAP traffic by reversing a hex → Base64 → XOR obfuscation chain used in a real DFIR CTF scenario TryHackMe, then exploits CVE-2023-32784 to recover a KeePass master password straight from a process memor...

Java-Shellcode-Loader

Java ShellCode Loader 基于Java实现的ShellCode加载器，兼容32位及64位平台。 核心原理是利用Jna来调用Windows API，实现shellcode的注入。 运行环境：Jre = 1.5 注：本项目已经内置在yzddmr6/As-Exploits的ShellCodeLoader模块中。 编译 maven package 使用 默认会随机注入32位进程，请使用32位的shellcode java -jar ShellcodeLoader.jar shellcodehex 注入x64位shellcode java -jar...

IntelligentProcessLifecycle

IntelligentProcessLifecycle The Intelligent Process Lifecycle of Active Cyber Defenders Description This github hosts the poster related files of false positive and error categories in security operation services. The goal is to define an open source reporting standard for Security Operation Cent...

Ekko

Ekko A small sleep obfuscation technique that uses CreateTimerQueueTimer Win32 API. Proof of Concept. Can be done better. NOTE This implementation has known flawes. So I wouldn't recommend using it without knowing how it works or know how to spot and fix those flaws. TLDR: don't copy and past it...

Dumpy

Description This tool dynamically calls MiniDumpWriteDump to dump lsass memory content. This process is done without opening a new process handle to lsass and using DInvokers to make it harder to detect its malicious behaviour. In order to obtain a valid process handle without calling OpenProcess...

TokenPlayer

TokenPlayer Manipulating and Abusing Windows Access Tokens. TokenPlayer is just a small tool i made to learn win32 api programming and understand better the access token model of windows. Features: Stealing and Impersonating primary tokens. Impersonating Protected Processes. Bypassing UAC by usin...

SleepyCrypt

SleepyCrypt A shellcode function to encrypt a running process image in memory when sleeping. This is the companion code for my blog post here. Build Just run build.sh to compile the C code, extract the .text section as shellcode, and compile it into a test binary called sleep.exe. This will requi...

PINKPANTHER

PINKPANTHER Brief Windows x64 kernel-mode handcrafted shellcode to replace primary access token of executing process with SYSTEM process token for Elevation of PrivilegeEoP. Supported OS Versions Windows 7/Windows Server 2008 R2 Build 7601 Windows 8/Windows Server 2012 Build 9200 Windows...

Chrome-Skia-CVE-2024-8193

Fixed in Chrome M128: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop28.html Steps to reproduce: 1. Apply the chromium.diff patch to chromium. 2. Run genskpic.py to generate drawablepicture.skp.hh, then move the generated file to src/gpu/commandbuffer/client. 3...

Chrome-Skia-CVE-2024-8198

Fixed in Chrome M128: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop28.html Steps to reproduce: 1. Apply the chromium.diff patch to chromium. 2. Run genskpic.py to generate drawablepicture.skp.hh, then move the generated file to src/gpu/commandbuffer/client. 3...

Chrome-Skia-CVE-2024-7966

Fixed in Chrome M128: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop21.html Steps to reproduce: Apply the chromium.diff patch to chromium. Run genskpic.py to generate drawablepicture.skp.hh, then move the generated file to src/gpu/commandbuffer/client. Build and...

CVE-2023-43876-October-CMS-Reflected-XSS---Installation

October CMS Reflected XSS v3.4.16 Author: Sergio Description: Cross-Site Scripting XSS vulnerabilitiy in installation of October v.3.4.16 allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost field. Attack Vectors: A vulnerability in the...

Raccine

Raccine A Simple Ransomware Protection Why We see ransomware delete all shadow copies using vssadmin pretty often. What if we could just intercept that request and kill the invoking process? Let's try to create a simple vaccine. How it works We register a debugger for vssadmin.exe and wmic.exe,...

RIPPL

RIPPL Manipulating PPL protected processes without using a driver This tool implements a userland exploit to manipulate Windows PPL protected processes. The technique was initially discussed by James Forshaw a.k.a. @tiraniddo and Clément Labro a.k.a. @itm4n in the following blogposts. Blog post...

breakcyserver

breakcyserver Full post in: https://waawaa.github.io/ 1. Kill EDR services by killing all the opened handles of the EDR process. 2. Bypass PPL by abussing some Process Explorer drivers functionalities. 3. Bypass ObRegisterCallbacks implementation by abussing Process Explorer driver...

MalwareForge---Advanced-Static-Malware-Analyzer

🛡️ MalwareForge - Advanced Static Malware Analyzer MalwareForge is a powerful static malware analysis tool that detects malicious behavior without executing the file. ✨ Features 🦠 Behavior Analysis : Process Injection, Persistence, Network, Stealer, Evasion 💉 8 Injection Techniques : Process...

CVE-2017-11882-Blocker

CVE-2017-11882-Blocker A Windows driver that neutralizes CVE-2017-11882 : How it works This project is split into a kernel driver and a user-mode notification component that talk over a custom device using the inverted call model. Kernel driver 1. Process callback - DriverEntry registers a...