44 matches found
RIPPL
RIPPL Manipulating PPL protected processes without using a driver This tool implements a userland exploit to manipulate Windows PPL protected processes. The technique was initially discussed by James Forshaw a.k.a. @tiraniddo and Clément Labro a.k.a. @itm4n in the following blogposts. Blog post...
CVE-2024-30088
CVE-2024-30088 This repository contains a Proof of Concept PoC written in Python for the vulnerability CVE-2024-30088. This code is an attempt to replicate the vulnerability as a technical exercise, with purely educational and demonstrative purposes, showing how Python somehow "struggles" also in...
EDRKiller
EDRKiller Use cve-2026-36425 killer edr，360 can killer Kills any antivirus processes, including but not limited to 360 Security and Huorong Security. I am exploiting a driver vulnerability for process manipulation, registering the driver via NT‑functions. No hiding is implemented. Compiled with...
invoker
Invoker Penetration testing utility and antivirus assessment tool. Built with Visual Studio Community 2022 v17.5.4 64-bit and tested on Windows 10 Enterprise OS 64-bit. Made for educational purposes. I hope it will help! This repository started to have known signatures and I don't have time to...
sleepall
sleepall Trojan based on the CVE-2024-28085 vulnerability https://people.rit.edu/sjf5462/6831711781/wall2272024.txt which is still unpatched anywhere. Essence: bash supports escape codes and we can control the appearance of the line in the terminal. The trojan listens to processes and looks for t...
concealed_code_execution
Ejecución de Código Oculto Hunt& Hackett presenta un conjunto de herramientas y documentos técnicos que describen técnicas de ataque que se basan en ocultar la ejecución de código en Windows. Aquí encontrará explicaciones de cómo funcionan estas técnicas, consejos sobre detección y código fuente ...
PT-2026-104017
Name of the Vulnerable Software and Affected Versions Kasa EC70 v4 Kasa EC71 v4 Description The production debug interface is not logically disabled at the firmware or chip level, and the bootloader remains unlocked. An attacker with physical access can restore physically severed debug traces to...
PT-2026-78318
As an inadvertent side effect of an unrelated code change, PRIV KTRACE was always denied to a jailed root user. Tracing configured by a jailed root user was therefore not flagged as privileged. An unprivileged user in a jail that has permission to debug the target process can modify the jailed ro...
EUVD-2026-51329
The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework TCF service that does not require any...
CVE-2026-12562
CVE-2026-12562 affects Toptech Systems RCU II+ and Multiload II+ devices. A network-accessible port runs a Target Communications Framework (TCF) service that does not require authentication, exposing a debug interface that grants full root access to the embedded Linux environment. An unauthentica...
CVE-2026-12562
The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework TCF service that does not require any...
TLSCheck 2.0: An Enhanced Memory Forensics Approach to Efficiently Detect TLS Callbacks
Memory analysis is a crucial technique in digital forensics that enables investigators to examine the runtime state of a system through physical memory dumps. While significant advances have been made in memory forensics, the detection and analysis of Thread Local Storage TLS callbacks remain...
CVE-2026-25752
FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attacker to modify device tags via WebSockets. Exploitation allows an unauthenticated, remote attacker to bypass role-based access controls and...
CVE-2021-27569
An issue was discovered in Emote Remote Mouse through 4.0.0.0. Attackers can maximize or minimize the window of a running process by sending the process name in a crafted packet. This information is sent in cleartext and is not protected by any authentication logic...
CVE-2018-25146
CVE-2018-25146 affects Microhard Systems IPn4G v1.1.0. Multiple connected docs confirm an undocumented vulnerability that allows authenticated attackers to list and manipulate running system processes by using a hidden feature to send arbitrary signals to kill background processes and system serv...
CVE-2025-67792
DriveLock is affected in versions 24.1 (before 24.1.6), 24.2 (before 24.2.7), and 25.1 (before 25.1.5). The issue allows local unprivileged users to manipulate a DriveLock process on Windows to execute arbitrary commands. Root cause details are not fully disclosed in the provided excerpts, but mu...
CVE-2025-59694
The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 patched in 13.6.12 LTS and 13.9.0 STS, allows a physically proximate attacker to persistently modify firmware and influence the insecurely configured appliance boot process. To exploi...
EUVD-2019-13227
Malware in sbrugna...