MalwareApiLibrary

MalwareApiLibrary : collection of apis used for malware development : StringManagementLib : manage strings, string hashes, and others WinApiManagementLib : replacement of GetModuleHandle and GetProcAddress functions SyscallsManagementLib : runs Hellsgate, TartarusGate, PerunsFart so far to unhook...

TamperingSyscalls

TamperingSyscalls TamperingSyscalls is a 2 part novel project consisting of argument spoofing and syscall retrival which both abuse EH in order to subvert EDRs. This project consists of both of these projects in order to provide an alternative solution to direct syscalls. Tampering with syscalls...

STrace

STrace Steve's Tracer. A DTrace on windows syscall hook reimplementation. Think of this like a patchguard compatible SSDT hook, but without hacks. This doesn't support SSSDT win32k apis, as the DTrace system call APIs themselves do not support this additional table. Zw kernel apis can be traced i...

CVE-2024-43630-POC

CVE-2024-43630-POC This repository contains a POC that triggers a stack OOB write when executed, causing the system to crash. This vulnerability is an extremely interesting and rare relic that demonstrates the complexities and peculiarities of kernel programming, especially object management...

access_updated

Singular Access Updated fork ofbtbd/access with Zydis-based dynamic pattern finding for Windows 10/11 compatibility A kernel-mode syscall wrapper that enables privileged process operations without requiring handles. Uses xKdEnumerateDebuggingDevices pointer hooking for kernel-usermode...

reproducer-poc-CVE-2022-0847

Naive detector and reproducer of CVE-2022-0847 dirty pipe. Uses simple generator of syscall sequences / programs from purposefully limited set of building blocks / input values only generation, no advanced fuzzing; no mutation; no coverage guidance; no shrinking / minimization and detects...

SharpWhispers

SharpWhispers C porting of SysWhispers2. It uses SharpASM to find the code caves for executing the system call stub. Read the blog post for the technical details: https://www.secforce.com/blog/sharpasm-sharpwhispers/ Requirements Visual Studio .NET Framework = 3.5 Python3 Usage root@kitploit: / /...

Linux Distros Unpatched Vulnerability : CVE-2026-89603

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - entry: Fix seccomp bypass after ptrace with TSYNC Sashiko review pointed out the following issue. If a thread is stopped in syscalltraceenter for ptrace, anothe...

Linux Distros Unpatched Vulnerability : CVE-2026-89489

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - openrisc: fix arbitrary kernel memory access via or1katomic syscall sysor1katomic syscall 244 in the or1k ABI takes two user pointers, v1 and v2, and swaps the...

voidsyscall

voidsyscall Zero WinAPI. Every NT primitive resolved at runtime from ntdll in memory — SYSCALL instructions issued directly via Plan9 assembly stubs, no import table, no ntdll usermode hooks touched. C2 over HTTPS / DNS / ICMP, AES-256-GCM per message. Windows native. Linux builds. macOS builds...

leaky-vessels-dynamic-detector

警告 此仓库现已归档。 代码将不再进行任何更新，当您阅读此通知时，它可能已不安全甚至无法使用。 请仅将其视为历史用途，并谨慎对待。 Leaky Vessels 动态检测器 在此仓库中，您将找到基于 eBPF 的运行时检测参考实现，用于检测 runc 和 Docker 漏洞 CVE-2024-21626、CVE-2024-23651、CVE-2024-23652 和 CVE-2024-23653。它挂钩 Linux 系统调用（例如 chdir、mount）以及 Docker 守护进程的函数调用，并将其与 Docker 构建和容器进程关联起来，以识别对这些漏洞的利用。...

TinyProcessor

TinyProcessor This project replaces syscall numbers & arguments in Tinytracer's .tag output w/ their actual Nt function declarations for better readability. Do note that some functions declarations are not included, so some arguments will not be processed The function declarations I use in this...

UnhookingPatch

UnhookingPatch Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime image How do i convert binary to MAC ? Requirements: 1. macaddress root@kitploit: pip install macaddress ./bin2mac.py calc.bin...

D1rkLdr

D1rkLdr Shellcode Loader with Indirect Dynamic syscall Implementation , shellcode in MAC format, API resolving from PEB, Syscall calll and syscall instruction address resolving at run time...

Hunt-Weird-Syscalls

Hunt-Weird-Syscalls This is a ETW based POC to monitor for abnormal syscalls. For now, the syscalls NtOpenThread and NtSetContextThread are monitored to identify IOCs indicating both direct and indirect syscalls. Description This project uses ETW, more precisely kernel based ETW providers, to...

ptrace-vuln

ptrace-vuln Para verificar la vulnerabilidad CVE-2019-13272 Es solo una prueba de concepto de muestra generada por un LLM y no cubre todos los casos. La idea básica es que si el sistema no está endurecido y ptrace no se ha eliminado, la vulnerabilidad debe considerarse aplicable. Pasos para...

CVE-2026-89603

In the Linux kernel, the following vulnerability has been resolved: entry: Fix seccomp bypass after ptrace with TSYNC Sashiko review pointed out the following issue. If a thread is stopped in syscalltraceenter for ptrace, another thread can install a seccomp filter with SECCOMPFILTERFLAGTSYNC e.g...

CVE-2026-89489

In the Linux kernel, the following vulnerability has been resolved: openrisc: fix arbitrary kernel memory access via or1katomic syscall sysor1katomic syscall 244 in the "or1k" ABI takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0r4 l.lwz...

DEBIAN-CVE-2026-89489

In the Linux kernel, the following vulnerability has been resolved: openrisc: fix arbitrary kernel memory access via or1katomic syscall sysor1katomic syscall 244 in the "or1k" ABI takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0r4 l.lwz...

CVE-2026-89603

CVE-2026-89603 is a race condition in the Linux kernel's syscall_trace_enter() that allows seccomp filter bypass via ptrace. When a thread is stopped for ptrace, another thread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC; however, syscall_trace_enter() evaluates a cached 'work' va...