122 matches found
pytmipe
PYTMIPE & TMIPE PYTMIPE PYthon library for Token Manipulation and Impersonation for Privilege Escalation is a Python 3 library for manipulating Windows tokens and managing impersonations in order to gain more privileges on Windows. TMIPE is the python 3 client which uses the pytmipe library...
PythonAESObfuscate
PythonAESObfuscate 以Python方式加载shellcode。还能为你生成一个EXE文件！ 使用方法 将原始的shellcode文件 payload.bin 放置在同一个目录下。默认架构为x86 运行 python obfuscate.py 默认输出为 out.py 依赖要求 Windows Python 2.7 Pyinstaller PyCrypto PyCryptodome似乎无法正常工作...
Ares
Ares Ares 是一个 Python 远程访问工具。 警告：请仅根据您当前的法律法规使用本软件。滥用此软件可能会引发法律和道德问题，我不支持也不对此负责。 Ares 由两个主要程序组成： 一个命令与控制（CnC）服务器，这是一个用于管理代理的 Web 界面 一个代理程序，运行在受控主机上，负责与 CnC 通信 Web 界面可以在任何运行 Python 的服务器上运行。代理可以使用 pyinstaller 编译为本机可执行文件。 设置 安装 Python 依赖： root@kitploit: pip install -r requirements.txt 初始化数据库：...
CVE-2019-16784-POC
CVE-2019-16784 POC 这就是我为 Windows PyInstaller 版本 strippathsincodeconstco, newfilename File "c:\users\ckrielle\appdata\local\programs\python\python38\lib\site-packages\PyInstaller\building\utils.py", line 660, in strippathsincode return codefuncco.coargcount, co.cokwonlyargcount, co.conlocals,...
Grok-backdoor
Grok-backdoor Grok-backdoor 是一个基于 Python 的简易后门程序，它使用 Ngrok 隧道进行 C&C 通信。通过 Pyinstaller，Ngrok-backdoor 可以生成 Windows、Linux 和 Mac 的可执行文件。 工作原理： Ngrok 通过安全隧道将位于 NAT 和防火墙后的本地服务器暴露到公共互联网上。 Ngrok 在恶意软件的本地监听端口和 Ngrok 服务器的公共 IP 之间建立一个隧道，并通过一个唯一的端口号进行通信。攻击者可以连接 Ngrok 公共 IP 和唯一端口，与内部恶意软件监听器进行交互。 免责声明：...
meterssh
Tool Name: MeterSSH Written by: David Kennedy Company: TrustedSec Website: https://www.trustedsec.com Twitter: @TrustedSec, @HackingDave MeterSSH is a way to take shellcode, inject it into memory then tunnel whatever port you want to over SSH to mask any type of communications as a normal SSH...
python-exe-unpacker
Autor: In Ming Loh [email protected] - @tantaryu Empresa: Countercept @countercept Sitio web: https://www.countercept.com Introducción Un script que ayuda a los investigadores a desempaquetar y descompilar ejecutables escritos en Python. Sin embargo, por ahora solo admite ejecutables creados...
PyInstallerPrivEsc
PyInstallerPrivEsc 用于 PyInstaller CVE-2019-16784 的漏洞利用 文章即将发布...
fudcrypt
fudcrypt Ofuscador basado en Python3 que puede evadir cualquier antivirus fácilmente. Importante: root@kitploit: 1. Asegúrate de que tu archivo payload tenga todas las librerías importadas y que sea un archivo payload válido. 2. Si tu payload es detectado, házmelo saber y actualizaré el stub. 3. ...
MAL-2026-10756 Malicious code in darkglitch (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a84fec55fc625d5e2b337aafe5a9a95ff30c47403241c59dbb33543ec97311a The package installs a listener CLI darkglitch -l -b that opens a WebSocket to the hardcoded signaling host malware-signal.vercel.app and joins the...
PYSEC-2026-1813 PyInstaller has local privilege escalation vulnerability
Impact Due to a special entry being appended to sys.path during the bootstrap process of a PyInstaller-frozen application, and due to the bootstrap script attempting to load an optional module for bytecode decryption while this entry is still present in sys.path, an application built with...
Hackers Use PyInstaller and AMSI Patching to Deliver XWorm RAT v7.4
Hackers are hiding XWorm malware in PyInstaller files to bypass Windows security, steal data and remotely control devices through ads...
Malicious code in polyutil (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 31a0fc68eee0841a78740fd3e3748171612b871b58bf9f3e52b4fa35bed64774 The package is prepared to download a hardcoded executable and save it in %LOCALAPPDATA% under a very generic name, clearly aiming to hide its existence. Code ...
MAL-2026-927 Malicious code in polyclawd (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 1f994af0e1b17c0d30e950a5aef9a45d8e34f6f59ab45fadddb05b340ed5cdad The package is prepared to download a hardcoded executable and save it in %LOCALAPPDATA% under a very generic name, clearly aiming to hide its existence. Code ...
Malicious code in polyclawd (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 1f994af0e1b17c0d30e950a5aef9a45d8e34f6f59ab45fadddb05b340ed5cdad The package is prepared to download a hardcoded executable and save it in %LOCALAPPDATA% under a very generic name, clearly aiming to hide its existence. Code ...
Malicious code in clawdist (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 3008887b6c2929530cd48dc996c91d70eb92432465d02f4ff28e6d5927350097 The package is prepared to download a hardcoded executable and save it in %LOCALAPPDATA% under a very generic name, clearly aiming to hide its existence. Code ...
CVE-2019-16784
In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is present in this particular case: If a software using PyInstaller in "onefile" mode is launched by a privileged user at least more than the current one which have his "TempPath" resolving to a world...
New VVS Stealer Malware Targets Discord Accounts via Obfuscated Python Code
Cybersecurity researchers have disclosed details of a new Python-based information stealer called VVS Stealer also styled as VVS $tealer that's capable of harvesting Discord credentials and tokens. The stealer is said to have been on sale on Telegram as far back as April 2025, according to a repo...
10 npm Packages Caught Stealing Developer Credentials on Windows, macOS, and Linux
Cybersecurity researchers have discovered a set of 10 malicious npm packages that are designed to deliver an information stealer targeting Windows, Linux, and macOS systems. "The malware uses four layers of obfuscation to hide its payload, displays a fake CAPTCHA to appear legitimate, fingerprint...
Privilege Escalation
PyInstaller is vulnerable to Privilege Escalation. The vulnerability is due to the bootstrap process appending a special entry to sys.path and attempting to load an optional bytecode-decryption module while that entry is present, which allows an attacker who can create files/directories next to t...