anticuckoo

anticuckoo 一款用于检测并崩溃Cuckoo Sandbox的工具。已在Cuckoo Sandbox官方和Accuvant的Cuckoo版本中测试。 请考虑捐赠：https://github.com/sponsors/therealdreg Anticuckoo 也能检测其他沙盒，如 FireEye（-c2）： Reddit / netsec 上关于 anticuckoo 的讨论 功能 检测: Cuckoo钩子检测（所有类型的Cuckoo钩子）。 自身内存中的可疑数据（不使用API，逐页扫描）。 崩溃（带参数执行）（在沙盒外这些参数不会使程序崩溃）： -c1：修改被钩API的RE...

CVE-2026-62958

Libriscv 中存在一个漏洞，攻击者可以利用越界读取导致沙箱崩溃。 创建 Bad elf： root@kitploit: python3 poc.py samplefile poisonedfile 结果： root@kitploit: ❯ python3 poc.py fib poisonedfile Manipulating .text section header at offset 0x250 Manipulating .symtab section header at offset 0x710 ❯ ./rvlinux poisonedfile fish: Job 1,...

openSUSE 16: WebKitGTK-4.0-lang / WebKitGTK-4.1-lang / WebKitGTK-6.0-lang / etc (openSUSE-SU-2026:21508-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21508-1 advisory. - CVE-2024-4367: missing type check when handling fonts in PDF.js can allow arbitrary JavaScript execution bsc1271638. - CVE-2026-39872:...

SUSE-SU-2026:3396-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: - CVE-2024-4367: missing type check when handling fonts in PDF.js can allow arbitrary JavaScript execution bsc1271638. - CVE-2026-39872: maliciously crafted web content can lead to an unexpected process crash bsc1271638. - CVE-2026-43663:...

Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript execution in PDF.js CVE-2024-4367 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash CVE-2026-39872 webkitgtk: webkitgtk:...

Security update for chromium (important)

This update to Chromium 63.0.3239.84 fixes the following security issues: - CVE-2017-5124: UXSS with MHTML - CVE-2017-5125: Heap overflow in Skia - CVE-2017-5126: Use after free in PDFium - CVE-2017-5127: Use after free in PDFium - CVE-2017-5128: Heap overflow in WebGL - CVE-2017-5129: Use after...

shopify-scripts: Null pointer dereference in mrb_class

The following code demonstrates a segfault in mruby and mruby-engine: module A module A ensure module A module A module A module A ensure module A module A module A module A module A module A a ensure module A yield end end end end end end end end end end end end end The mruby crash is due to a...

shopify-scripts: Crash: A call to Symbol.new leads to a crash when inspecting the resulting object

Calling Symbol.new leads to a when inspect is called on that method probably even more methods. From my point of view the root cause is related to 185794 the underlying boxing model. Trying the same with Ruby 2.3 will lead to a NoMethodError: undefined method 'new' for Symbol:Class, which is...

shopify-scripts: SIGSEV on mrb_ary_splice

Sample The following code causes a SIGSEV when executed under the sandbox t0me=methods t0me0,0=t0me Crash Here we can see the crash full crash output attached $ bin/sandbox /tmp/mrbarysplice-crash.rb bin/sandbox:21: BUG Segmentation fault at 0x00005200000004 ruby 2.3.1p112 2016-04-26...