clrinject

clrinject Inyecta un ensamblado EXE o DLL de C en cualquier runtime CLR y AppDomain de otro proceso. El ensamblado inyectado puede entonces acceder a instancias estáticas de las clases del proceso infectado y por lo tanto afectar su estado interno. Uso clrinject-cli.exe -p -a Abre el proceso con ...

shad0w

SHAD0W SHAD0W es un framework C2 modular diseñado para operar con éxito en entornos maduros. Utiliza una variedad de métodos para evadir EDR y AV, permitiendo al operador seguir usando las herramientas y técnicas que conoce. Está impulsado por Python 3.8 y C, y usa Donut para la generación de...

inject-assembly

inject-assembly - Ejecutar .NET en un Proceso Existente Esta herramienta es una alternativa a la ejecución tradicional fork and run para Cobalt Strike. El cargador puede ser inyectado en cualquier proceso, incluido el Beacon actual. Los ensamblados de larga duración continuarán ejecutándose y...

invoker

Invoker Utilidad de pruebas de penetración y herramienta de evaluación antivirus. Construido con Visual Studio Community 2022 v17.5.4 64 bits y probado en Windows 10 Enterprise OS 64 bits. Hecho con fines educativos. ¡Espero que sea de ayuda! Este repositorio comenzó a tener firmas conocidas y no...

VX-API

管理元: vx-underground | Twitterでフォローする Twitter | VXUG/samplesページでマルウェアサンプルをダウンロード VXUG/samples VX-API バージョン: 2.01.015 開発者: smellyvx VX-APIは、マルウェア開発を支援する悪意のある機能のコレクションです。このリポジトリ全体をクローンまたはダウンロードし、Visual Studioソリューションファイルを開いて機能やコンセプトを簡単に探索することをお勧めします。...

Exploit for Heap-based Buffer Overflow in Microsoft

!Rulehttps://img.shields.io/badge/RULE-SOC335-00FF41?style=fo...

r2frida v6.2.2

r2frida Radare2 and Frida better together Description Self-contained plugin for radare2 that ships frida and allows to instrument local or remote processes using r2 commands instead but not limited to Frida scripts. The radare project provides a complete toolchain for reverse engineering, it's...

AxHunter — Updated!

AxHunter PoCs for Wellbia XIGNCODE3 anti-cheat xhunter driver family — xhunter1.sys v2023.12.7.78 CVE-2026-3609 and xhunter2.sys v2026.6.1.192 CVE-2026-15430. Workspace layout Cargo workspace, three crates: AxHunter/ ├── Cargo.toml workspace manifest ├── axhunter-lsa/ shared crate — driver-agnost...

UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

UAT-10147 is a highly capable Chinese-speaking intrusion actor operating a multi-platform post-exploitation ecosystem targeting IIS and Linux servers, combining search engine optimization SEO fraud monetization with advanced persistence and defense evasion techniques. The newly identified SPECTRE...

CVE-2026-68519

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes securepopen with shell operators enabled, allowing configured redirection, command chaining, or pipes to...

Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers

Cybersecurity researchers have detailed a post-exploitation technique that enables the Chrome DevTools Protocol CDP inside a running Google Chrome or Microsoft Edge process on Windows, allowing an operator to access cookies, saved data, and authenticated browser sessions. The technique assumes th...

Black Hat Europe 2023 Conference Slides

Black Hat Europe 2023 conference slides for topics Unmasking APTs: An Automated Approach for Real-World Threat Attribution, How I Learned to Stop Worrying and Build a Modern Detection & Response Program, The Pool Party You Will Never Forget: New Process Injection Techniques Using Windows Thread...

ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures

Cybersecurity researchers have flagged multiple ClickFix campaigns that deliver three malware loaders called BabaDeda Loader , Lorem Ipsum Loader , and Potemkin , per independent reports from Morphisec, BlueVoyant, and Huntress, respectively. Attacks involving BabaDeda Loader, observed in April...

Exploit for CVE-2026-31431

CVE-20...

From fake Proton VPN sites to gaming mods, this Windows infostealer is everywhere

We’ve uncovered multiple campaigns distributing an infostealer we track as NWHStealer , using everything from fake VPN downloads to hardware utilities and gaming mods. What makes this campaign stand out isn’t just the malware, but how widely and convincingly it’s being spread. Once installed, it...

DEAD#VAX Malware Campaign Deploys AsyncRAT via IPFS-Hosted VHD Phishing Files

Threat hunters have disclosed details of a new, stealthy malware campaign dubbed DEADVAX that employs a mix of "disciplined tradecraft and clever abuse of legitimate system features" to bypass traditional detection mechanisms and deploy a remote access trojan RAT known as AsyncRAT. "The attack...

EUVD-2020-10101

Malware in sbrugna...

EUVD-2024-32093

Malicious code in bioql PyPI...

ProcessInjection

It is an offensive tool for Windows. This repository contains proof-of-concept PoC code for injecting a DLL into a running process on Windows. The primary CVE ID is not explicitly stated, but the code appears to target a vulnerability in the Windows operating system. The target product/service is...

sudo_inject

Linux Privilege Escalation by injecting process possessing sudo tokens Inject process that have valid sudo token and activate our own sudo token Introduction We all noticed that sometimes sudo doesn't ask us for a password because he remembers us. How does he remember us and how does he identifie...