ppid-spoofing

https://www.countercept.com/blog/detecting-parent-pid-spoofing/...

Raccine

Raccine 一款简单的勒索软件防护工具 为什么 我们经常看到勒索软件使用 vssadmin 删除所有卷影副本。如果我们能直接拦截该请求并终止调用它的进程会怎样？让我们尝试创建一个简单的疫苗。 工作原理 我们为 vssadmin.exe（和 wmic.exe）注册一个调试器，也就是我们编译好的 raccine.exe。Raccine 是一个二进制程序，首先收集所有父进程的 PID，然后尝试终止所有父进程。 优点： 该方法相当通用 我们无需替换系统文件（vssadmin.exe 或 wmic.exe），替换系统文件可能会导致完整性问题，并在每个补丁日破坏我们的 Raccine 接种...

CVE-2017-11882-Blocker

CVE-2017-11882-Blocker 一个可以消除 CVE-2017-11882 的 Windows 驱动程序 : 工作原理 该项目分为一个内核驱动程序和一个用户态通知组件，它们通过使用反转调用模型 的自定义设备进行通信。 内核驱动程序 1. 进程回调 - DriverEntry 注册一个 PsSetCreateProcessNotifyRoutineEx 回调，使得驱动程序在每次系统范围内创建进程时、在进程开始执行之前被同步调用。 2. 父进程检查 - 在回调内部，驱动程序通过 ZwOpenProcess 打开父进程并查询 ProcessImageFileName 以获取完整的...

SelectMyParent

这是什么 这是一个用于父进程欺骗的项目。 使用方法 步骤 1：选择一个父进程并记住其 PID 步骤 2：执行以下命令，实现父进程欺骗 root@kitploit: SelectMyParent.exe notepad 928 步骤 3：使用进程资源管理器查看进程树，即可看到欺骗成功 参考 https://pentestlab.blog/2020/02/24/parent-pid-spoofing https://ired.team/offensive-security/defense-evasion/parent-process-id-ppid-spoofing...

NPM: Electron: Parent process code-sign check is spoofable

NPM: Electron: Parent process code-sign check is spoofable vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

GHSA-JM7P-CC5G-QWXX Electron: Parent process code-sign check is spoofable

Impact On macOS, the check Electron uses to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable the fuse-based hardening restricting ELECTRONRUNASNODE and NODEOPTIONS to same-signed parents rely on this check; a local attacker could bypas...

CVE-2026-70597

Electron on macOS had a bug where the code-sign check that verifies a launched app’s parent process could be bypassed by a local attacker. This affects Electron versions prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3. By exploiting this, a local attacker could bypass the fuse-based hardening ...

SUSE CVE-2026-46259

In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading realparent in dotaskstat When reading /proc/pid/stat, dotaskstat accesses task-realparent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- dotaskstat var =...

EUVD-2016-4992

Malware in sbrugna...

EUVD-2021-7368

Malicious code in bioql PyPI...

CVE-2024-43704

Software installed and run as a non-privileged user may conduct improper GPU system calls to gain access to the graphics buffers of a parent process...

Imagination GPU Driver 安全漏洞

Imagination GPU Driver is a graphics driver from Imagination. A security vulnerability exists in Imagination GPU Driver DDK24.2 RTM1 and earlier versions, which originates from software installed and run as an unprivileged user, and may make improper GPU system calls to access the graphics buffer...

firefox: DOM push subscription message could hang Firefox

The Mozilla Foundation's Security Advisory: By sending a specially crafted push message, a remote server could hang the parent process, causing the browser to become unresponsive...

firefox: DOM push subscription message could hang Firefox

The Mozilla Foundation's Security Advisory: By sending a specially crafted push message, a remote server could hang the parent process, causing the browser to become unresponsive...

firefox: DOM push subscription message could hang Firefox

The Mozilla Foundation's Security Advisory: By sending a specially crafted push message, a remote server could hang the parent process, causing the browser to become unresponsive...

firefox: DOM push subscription message could hang Firefox

The Mozilla Foundation's Security Advisory: By sending a specially crafted push message, a remote server could hang the parent process, causing the browser to become unresponsive...

firefox: DOM push subscription message could hang Firefox

The Mozilla Foundation's Security Advisory: By sending a specially crafted push message, a remote server could hang the parent process, causing the browser to become unresponsive...

firefox: DOM push subscription message could hang Firefox

The Mozilla Foundation's Security Advisory: By sending a specially crafted push message, a remote server could hang the parent process, causing the browser to become unresponsive...

CVE-2024-10466

The Mozilla Foundation's Security Advisory: By sending a specially crafted push message, a remote server could hang the parent process, causing the browser to become unresponsive...

CVE-2024-10466

By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive. This vulnerability affects Firefox 132, Firefox ESR 128.4, Thunderbird 128.4, and Thunderbird 132...