laZzzy

laZzzy laZzzy 是一个 shellcode 加载器，演示了恶意软件常用的多种执行技术。laZzzy 使用了不同的开源仅头文件库开发而成。 功能特点 直接系统调用和原生（Nt）函数（并非全部，但大部分） 导入地址表（IAT）规避 加密载荷（XOR 和 AES） 随机生成的密钥 使用时自动用 NOP（\x90）填充（必要时） 内存中逐字节解密载荷 XOR 加密的字符串 PPID 欺骗 阻止非微软签名的 DLL 加载 （可选）克隆 PE 图标和属性 （可选）使用伪造证书进行代码签名 使用方法 环境要求： 安装了 Visual Studio 及其以下组件的 Windows 机器（可从...

ByteCaster

ByteCaster Navaja suiza para el cifrado de payloads, ofuscación y conversión a arrays de bytes: ¡todo en un solo comando! Es compatible con 3 algoritmos de cifrado, 4 algoritmos de codificación / ofuscación y 14 formatos de salida. Instalación Descargue el binario compilado o compile el código...

pycrypt

pycrypt Crypter basado en Python que puede eludir cualquier tipo de producto antivirus Nota: root@kitploit: Si el stub es detectado, por favor usa las siguientes ofuscaciones:- 1. https://github.com/machine1337/fudcrypt 2. https://github.com/machine1337/pyobfuscate Importante: root@kitploit: 1...

GG-AESY

博客文章：https://redteamer.tips/introducing-gg-aesy-a-stegocryptor/ 警告：你可能需要还原NuGet包并重启Visual Studio才能编译。如果有人知道如何解决这个问题，请私信我。 手册 首先， 我强烈建议始终使用GG-AESY的详细模式或非常详细模式。如果你不使用非托管加载器，我也建议始终指定输出文件（outfile）。 不过请注意，在非常详细模式下，特别是当你要隐藏大型有效载荷时，该模式会将字节数组打印到控制台。 话虽如此，让我们深入了解这个工具的手册。 root@kitploit: . / | / | / \ | | /...

sdc

root@kitploit: +------------------------------------------------------------------------------+ SDC - Self Decrypting Binary Generator Copyright C 2006 Claes M Nyberg +------------------------------------------------------------------------------+ -= ¿Qué es esto? root@kitploit: El programa SDC...

cve-2025-59287

CVE-2025-59287 - WSUS 利用工具包 作者：adel-h4x0a ⚠️ 仅限教育和授权测试用途 ⚠️ 概述 本工具包演示了 CVE-2025-59287 的利用过程，这是 Windows Server Update Services WSUS 中的一个远程代码执行漏洞。 组件 1. 加密模块 cve-2025-59287-encr.py · 用于 WSUS 通信的 AES 载荷加密 · 支持传统和安全两种加密模式 · 自定义载荷生成 2. 利用模块 cve-2025-59287-exp.py · CVE-2025-59287 的完整利用链 · 健壮的错误处理和重试逻辑 ·...

DotNET_XorCryptor

DotNET XorCryptor También puedes prestar atención a un proyecto anterior - NET-MalwareCryptor Este es un empaquetador de ejecutables .NET con cifrado de payload. Úselo solo con fines educativos. ¿Cómo usar? --file path - especificar nombre de archivo --flood - añadir clases basura al archivo...

CVE-2026-31431-exp

Adaptado de https://github.com/theori-io/copy-fail-CVE-2026-31431. Se han añadido características como cifrado y ofuscación del payload, escritura de caché para mejorar la estabilidad del sistema, chunks adaptativos, cero dependencias y soporte multiarquitectura x86, arm, i386, etc.. En teoría, s...

fudcrypt

fudcrypt Ofuscador basado en Python3 que puede evadir cualquier antivirus fácilmente. Importante: root@kitploit: 1. Asegúrate de que tu archivo payload tenga todas las librerías importadas y que sea un archivo payload válido. 2. Si tu payload es detectado, házmelo saber y actualizaré el stub. 3. ...

Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware

The China-linked cybercrime group behind the use of income tax-related phishing lures targeting Indian taxpayers, tax professionals, and corporate finance teams has been observed using a sophisticated crypter service called Cruciferra. According to a new analysis by Proofpoint, Cruciferra has bee...

China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks

An exposed Alibaba Cloud server has revealed a China-nexus operation that Group-IB tracks as JadeProx. The cluster has targeted government, healthcare, and education organizations across Asia and Latin America with a previously undocumented Windows loader called TriBack Loader. Group-IB found the...

DEBIAN-CVE-2026-15812

A vulnerability was found in the internal Access Control List ACL subsystem of kronosnet Version affected: = 1.34. When the framework is explicitly configured to manage dynamic links accepting network traffic from any IP address without network payload encryption, the validation architecture...

FTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)

Fetch and execute an x86 payload from an FTP server. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP includ...

FTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)

Fetch and execute an x86 payload from an FTP server. Listen for a connection Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP include...

MiracleLinux 9 : delve-1.21.2-2.el9, golang-1.21.9-2.el9 (AXSA:2024-7759:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7759:01 advisory. golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads CVE-2024-1394 golang: net/http: memory exhaustion in...

CVE-2025-34433

AVideo 14.3.1–20.0.x isaffected by an unauthenticated RCE due to insecure salt generation: installation salt is created with PHP uniqid(), and the installation timestamp plus a derived hashId are exposed publicly, enabling offline brute-forcing of the remaining entropy to recover the salt. Attack...

Exploit for Out-of-bounds Write in Mediatek Software_Development_Kit

What is Registry Exploit? Phantom-Registry-Exploit-Cve2025-20...

CVE-2020-25493

Oclean Mobile Application 2.1.2 communicates with an external website using HTTP so it is possible to eavesdrop the network traffic. The content of HTTP payload is encrypted using XOR with a hardcoded key, which allows for the possibility to decode the traffic...

Writing a BugSleep C2 server and detecting its traffic with Snort

In June 2024, security researchers published their analysis of a novel implant dubbed "MuddyRot"aka "BugSleep". This remote access tool RAT gives operators reverse shell and file input/output I/O capabilities on a victim's endpoint using a bespoke command and control C2 protocol. This blog will...

RHEL 9 : runc (RHSA-2024:4762)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4762 advisory. The runC tool is a lightweight, portable implementation of the Open Container Format OCF that provides container runtime. Security Fixes:...