injectAmsiBypass

Cobalt Strike BOF - AMSIバイパス注入 コードインジェクションを使用してリモートプロセス内のAMSIをバイパスするCobalt Strike Beacon Object File（BOF）です。 CobaltStrikeからのinject-amsiBypass BOFの実行 これは何をするものですか？ 1. 指定されたPID引数を使用してリモートプロセスのハンドルを取得します root@kitploit: hProc = KERNEL32$OpenProcessPROCESSVMOPERATION | PROCESSVMWRITE, FALSE, DWORDpid;...

inject-assembly

inject-assembly - Execute .NET in an Existing Process This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon,...

shed

Shed - .NET runtime inspector Shed is an application that allow to inspect the .NET runtime of a program in order to extract useful information. It can be used to inspect malicious applications in order to have a first general overview of which information are stored once that the malware is...

Split

描述 分而治之是一种编程中常用的算法，通过将复杂的问题分解为许多更简单的子问题来解决它。我们可以将这种方法以不同的目标应用于进攻性安全：迷惑 EDR，使其无法跟踪我们的活动，从而阻止它们触发任何警报。这类似于最近在现实攻击中几乎任何钓鱼活动中都能看到的情况：长感染链，逐步运行多个文件（例如 .url - .one - .js - .bat - .dll），而不是直接运行最终载荷。每个被运行的文件都执行一个简单的任务（下载另一个文件、对注册表进行任何更改、在目录之间移动文件或更改其名称/扩展名等），单独来看很难将这些任务标记为恶意，以此来为最终执行准备环境。...

CVE-2026-85451

MOOS core-moos through 10.4.0 is affected by a remote process termination vulnerability in the SuicidalSleeper component. The root cause is a hard-coded passphrase used for multicast command authorization, allowing any multicast-reachable peer to enumerate MOOS processes and send termination comm...

CVE-2026-85451 MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphrase

MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process...

HTTP Response Splitting

Overview Affected versions of this package are vulnerable to HTTP Response Splitting via the headers option in the Remote process. An attacker can inject or override HTTP headers in outgoing requests by including newline characters in user-controlled input that is forwarded to the header value...

MBS多款产品 输入验证错误漏洞

MBS Single-A and other products are a series of industrial communication gateways developed by the German company MBS. Several MBS products have a vulnerability related to input validation errors. This vulnerability stems from the insufficient input validation provided by the ugw-logstop method,...

Apache HTTP Server 代码问题漏洞

Apache HTTP Server is an open-source web server developed by the Apache Foundation in the United States. This server is known for its speed, reliability, and ability to be expanded through simple APIs. Versions of Apache HTTP Server 2.4.66 and earlier have code vulnerabilities related to null...

EUVD-2019-20058

Remote Process Explorer 1.0.0.16 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by sending a crafted payload to the Add Computer dialog. Attackers can paste a malicious string into the computer name textbox and trigger a crash by connecting to th...

CVE-2019-25661

Remote Process Explorer 1.0.0.16 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by sending a crafted payload to the Add Computer dialog. Attackers can paste a malicious string into the computer name textbox and trigger a crash by connecting to th...

CVE-2019-25661

Remote Process Explorer 1.0.0.16 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by sending a crafted payload to the Add Computer dialog. Attackers can paste a malicious string into the computer name textbox and trigger a crash by connecting to th...

CVE-2019-25661 Remote Process Explorer 1.0.0.16 Local Buffer Overflow DoS

Remote Process Explorer 1.0.0.16 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by sending a crafted payload to the Add Computer dialog. Attackers can paste a malicious string into the computer name textbox and trigger a crash by connecting to th...

CVE-2019-25661 Remote Process Explorer 1.0.0.16 Local Buffer Overflow DoS

Remote Process Explorer 1.0.0.16 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by sending a crafted payload to the Add Computer dialog. Attackers can paste a malicious string into the computer name textbox and trigger a crash by connecting to th...

CVE-2019-25661

Remote Process Explorer 1.0.0.16 is affected by a local buffer overflow in the Add Computer dialog. A crafted string pasted into the computer name textbox can crash the added computer by overwriting the SEH chain, causing denial of service. The issue is local, with low attack complexity and no pr...

LizardSystems Remote Process Explorer 缓冲区错误漏洞

LizardSystems Remote Process Explorer is a remote process management tool developed by LizardSystems. Version 1.0.0.16 of Remote Process Explorer contains a buffer overflow vulnerability. This vulnerability stems from a local buffer overflow in the “Add Computer” dialog box, which could allow...

PT-2026-30470

Remote Process Explorer 1.0.0.16 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by sending a crafted payload to the Add Computer dialog. Attackers can paste a malicious string into the computer name textbox and trigger a crash by connecting to th...

EUVD-2018-3115

Malware in sbrugna...

EUVD-2024-34379

Malicious code in bioql PyPI...

EulerOS 2.0 SP13 : git (EulerOS-SA-2025-1614)

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Git is a source code management tool. When cloning from a server or fetching, or pushing, informational or error messages are transported from the...