pftriage

pftriage pftriage is a tool to help analyze files during malware triage. It allows an analyst to quickly view and extract properties of a file to help during the triage process. The tool also has an analyze function which can detect common malicious indicators used by malware. Dependencies pefile...

peframe

======= peframe peframe is a open source tool to perform static analysis on Portable Executable malware and generic suspicious file. It can help malware researchers to detect packer, xor, digital signature, mutex, anti debug, anti virtual machine, suspicious sections and functions, macro and much...

pwndoc

PwnDoc PwnDoc is a pentest reporting application making it simple and easy to write your findings and generate a customizable Docx report. The main goal is to have more time to Pwn and less time to Doc by mutualizing data like vulnerabilities between users. Documentation Installation Data Roles...

CVE-2018-4121

CVE-2018-4121 - Safari Wasm Sections POC RCE 익스플로잇 MWR Labs 작성 c 2018 세부사항 이 개념 증명 익스플로잇은 macOS 10.13.3 17D47의 Safari 11.0.3 13604.5.6 버전만을 대상으로 합니다. 원하는 페이로드를 생성자와 함께 dylib로 컴파일하십시오. python filetojsarray.py your.dylib payload.js 실행 이 디렉토리를 서비스하고 Safari를 /exploit.html로 지정하십시오. 익스플로잇은 완전히 신뢰할 수 없으...

pefile

pefile pefile은 Portable Executable PE 파일을 파싱하고 다루기 위한 다중 플랫폼 Python 모듈입니다. PE 파일 헤더에 포함된 대부분의 정보와 모든 섹션의 세부 정보 및 데이터에 접근할 수 있습니다. Windows 헤더 파일에 정의된 구조는 PE 인스턴스의 속성으로 접근할 수 있습니다. 필드/속성의 명명은 해당 헤더의 명명 체계를 따르려고 합니다. 편의를 위해 추가된 바로가기만 해당 규칙에서 벗어납니다. pefile은 PE 파일 레이아웃에 대한 기본적인 이해가 필요합니다. 이를 통해 PE 파일...

CVE-2018-4121

CVE-2018-4121 - Safari Wasm 섹션 POC RCE 익스플로잇 by MWR Labs c 2018 세부 사항 이 개념 증명 익스플로잇은 macOS 10.13.3 17D47의 Safari 11.0.3 13604.5.6 버전만 대상으로 합니다. 원하는 페이로드를 생성자constructor가 있는 dylib로 컴파일합니다. python filetojsarray.py your.dylib payload.js 실행 이 디렉토리를 서비스하고 Safari를 /exploit.html로 연결합니다. 익스플로잇은 완전히 신뢰할 수...

wibu-codemeter-analysis

WIBU CodeMeter DLL 암호 분석 WIBU-Systems CodeMeter 보호에 대한 독립적인 보안 연구 책임 공개 공급업체 통보: 2025년 12월 24일 공개 기간: 90일 공개 발표: 2026년 3월 24일 범위: WibuBz32.dll 분석만 요약 WIBU CodeMeter 런타임 라이브러리 분석 결과, 사용자 정의 PE 섹션에서 AES-256 암호화와 일치하지 않는 특성이 발견되었습니다. 주요 발견 사항: 측정 항목| 예상 AES-256| 관찰| 편차 ---|---|---|--- 샤넌 엔트로피| ≥7.9...

EmbedPayloadInPng

EmbedPayloadInPng PNG 파일 내에 페이로드를 여러 IDAT 섹션에 분산하여 삽입합니다. 각 섹션은 RC4 암호화 알고리즘을 사용하여 고유한 16바이트 키로 개별적으로 암호화됩니다. 빠른 링크 Maldev Academy 홈 Maldev Academy 강의 계획서 Maldev Academy 가격 구현 이 저장소는 두 가지 구현으로 구성되어 있습니다: EmbedPayloadInPng.py - 입력된 페이로드를 지정된 PNG 파일에 삽입하는 Python 스크립트. FetchPayloadFromPng -...

CVE-2018-4121

CVE-2018-4121 - Safari Wasm 섹션 POC RCE 익스플로잇 MWR Labs 제작 c 2018 세부 정보 이 개념 증명 익스플로잇은 macOS 10.13.3 17D47의 Safari 11.0.3 13604.5.6 버전만을 대상으로 합니다. 선택한 페이로드를 생성자constructor가 있는 dylib로 컴파일하십시오. python filetojsarray.py your.dylib payload.js를 실행하십시오. 이 디렉토리를 서빙하고 Safari가 /exploit.html을 가리키게 하십시오. 익스플로잇...

CVE-2026-82399

A flaw was found in CoreDNS. An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted DNS requests over custom transports, such as DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC. By using DNS name compression and excessive section counts, t...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: kexec: deriving the entry from the purgatory symbol The kexecloadpurgatory function derives image-start by locating eentry within an SHFEXECINSTR section. If the purgatory object contains multiple executable sections with...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: objtool: A memory leak has been fixed in the createStaticcallsections function. strdup allocates memory for keyname. We need to release this memory in the following error-prone code paths. Add free to avoid the memory leak...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: rvcm: Fix the out-of-bound issue with vmemmap addresses In the sparse vmemmap model, the virtual address of vmemmap is calculated as: struct page VMEMMAPSTART - physrambase PAGESHIFT. The virtual address of a struct page can also...

CVE-2026-84792 Craft CMS before 5.10.11 Broken Access Control via element-indexes

Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized...

CVE-2026-84792 Craft CMS before 5.10.11 Broken Access Control via element-indexes

Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized...

CVE-2026-80577

A flaw was found in the Linux kernel's drm/panthor driver. When the panthorfwloadsectionentry function processes zero-sized firmware sections, it can leave a memory pointer uninitialized. Subsequent operations that attempt to access this uninitialized memory can lead to a null pointer dereference...

CVE-2026-80577

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: skip zero-sized firmware sections panthorfwloadsectionentry skips BO creation when the firmware section VA range is empty. If such a section is added to the firmware section list, section-mem is left as NULL. Later...

CVE-2026-80577

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: skip zero-sized firmware sections panthorfwloadsectionentry skips BO creation when the firmware section VA range is empty. If such a section is added to the firmware section list, section-mem is left as NULL. Later...

UBUNTU-CVE-2026-80577

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: skip zero-sized firmware sections panthorfwloadsectionentry skips BO creation when the firmware section VA range is empty. If such a section is added to the firmware section list, section-mem is left as NULL. Later...

CVE-2026-80577

This vulnerability affects the Linux kernel DRM Panthor driver (Arm Mali GPU subsystem). The root cause is in panthor_fw_load_section_entry(): when a firmware section has an empty VA range , BO (Buffer Object) creation is skipped, leaving section->mem as NULL . Subsequent reload and unplug pat...