DeathSleep

██████╗ ███████╗ █████╗ ████████╗██╗ ██╗███████╗██╗ ███████╗███████╗██████╗ ██╔══██╗██╔════╝██╔══██╗╚══██╔══╝██║ ██║██╔════╝██║ ██╔════╝██╔════╝██╔══██╗ ██║ ██║█████╗ ███████║ ██║ ███████║███████╗██║ █████╗ █████╗ ██████╔╝ ██║ ██║██╔══╝ ██╔══██║ ██║ ██╔══██║╚════██║██║ ██╔══╝ ██╔══╝ ██╔═══╝...

ThreadStackSpoofer

Thread Stack Spoofing / Call Stack Spoofing PoC A PoC implementation for an advanced in-memory evasion technique that spoofs Thread Call Stack. This technique allows to bypass thread-based memory examination rules and better hide shellcodes while in-process memory. Intro This is an example...

MalDev

MalDev Hey! Welcome to my repo : I am Captain Magma, a passionate individual dedicated to cybersecurity, malware development, and analysis. The design for this repository is to manage my MalDev road-path as I learn and update this repository with my notes and code. I am not the author of any of...

CVE-2024-29824

I have made some optimizations to the scripts in horizon3ai actually, it is just adding a verification mechanism to ensure accuracy Original project address: https://github.com/horizon3ai/CVE-2024-29824 add "-f / --file" and ThreadPool...

CVE-2018-6389

doser.py DoS tool for HTTP requests inspired by hulk but has more functionalities written in Python: Examples 999 threads sends GET requests: python doser.py -t 999 -g 'https://targeted.site.com' 999 threads sends POST requests with json data: python doser.py -t 999 -p 'https://targeted.site.com'...

CVE-2026-8389

CVE-2026-8389 This vulnerability was intended to be used at Pwn2Own 2026 Berlin, but was patched in version 150.0.3. SpiderMonkey BaselineJIT pcOffset bitfield truncation on the eager off-thread baseline-compile path, leading to a wrong-but-in-bounds bytecode pc during exception unwinding and a...

PSI_BOF

ProcessInspect BOF A CS BOF which can be used to inspect process memory, addresses and symbols! Overview of commands Command| Description ---|--- lm| list all loaded modules along with base address, entry point, and more addr| Print the bytes at a given memory address meminfo| Print information f...

WP-DOS-Exploit-CVE-2018-6389

WP-DOS-Exploit-CVE-2018-6389 This is a exploit of Wordpress DOS attack CVE 2018-6389. USE python3 wp-dosCVE-2018-6389.py domain threads Example python3 wp-dosCVE-2018-6389.py http://example.com 1000...

BeaconHunter

BeaconHunter Behavior based monitoring and hunting tool built in C leveraging ETW tracing. Blue teamers can use this tool to detect and respond to potential Cobalt Strike beacons. Red teamers can use this tool to research ETW bypasses and discover new processes that behave like beacons. Author :...

moneta

/ \ / | / \ / \ / \ / / \ \ / Y | \ /| | / | //| | / | / / / / / Moneta v1.0 | Forrest Orr | 2020 REQUIRED -m |region|referenced|ioc -p |PID OPTIONAL -v detail|debug|surface -d --option from-base|statistics --filter unsigned-module|clr-prvx|clr-heap|metadata-modules --address --region-size -m...

brash

Brash Chromium Browser DoS Attack via document.title Exploitation Brash is a critical vulnerability in Blink , the rendering engine that powers Google's Chromium-based browsers. It allows any Chromium browser to collapse in 15-60 seconds by exploiting an architectural flaw in how certain DOM...

elevationstation

Elevation Station Stealing and Duplicating SYSTEM tokens for fun & profit! We duplicate things, make twin copies, and then ride away. You have used Metasploit's getsystem and SysInternals PSEXEC for getting system privs, correct? Well, here's a similar standalone version of that...but without the...

Log4j_CVE-2021-45046

Log4j 2.15.0 Privilege Escalation -- CVE-2021-45046 Attack Discription It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map MDC input data when the logging...

vulns

취약점 보고서 HN Security의 보안 권고. https://hnsecurity.it/ Solaris HNS-2022-01-dtprintinfo. Solaris dtprintinfo와 libXm/libXpm의 여러 취약점 CVE-2022-46285, CVE-2023-24039, CVE-2023-24040. Zyxel HNS-2022-02-zyxel-zysh. Zyxel zysh의 여러 취약점 CVE-2022-26531, CVE-2022-26532. HNS-2025-10-zyxel-fermion. Zyxel uOS의 로컬 권...

Driver-HideKernelThread-IoCancelIrp

Driver-HideKernelThread-IoCancelIrp 自分のコードではない。保存用のみ https://bbs.pediy.com/thread-272795.htm 原理 スレッドのエントリアドレスをIoCancelIrpに、コンテキストを作成したirpに設定する。 するとスレッドはIoCancelIrpを呼び出す。呼び出されると、IRPをキャンセルする操作を実行する。 これによりIRP-CancelRoutineが呼び出される。したがって、自身のスレッドエントリアドレスをIRP-CancelRoutineに設定するだけでよい。 検出方法は？...

slowloris

slowloris.py - 파이썬으로 만든 간단한 slowloris Slowloris란 무엇인가? Slowloris는 기본적으로 스레드 기반 서버에 영향을 미치는 HTTP 서비스 거부 공격입니다. 작동 방식은 다음과 같습니다: 1. 많은 HTTP 요청을 시작합니다. 2. 연결을 유지하기 위해 주기적으로약 15초마다 헤더를 보냅니다. 3. 서버가 연결을 닫지 않는 한 절대 연결을 닫지 않습니다. 서버가 연결을 닫으면 새 연결을 만들어 같은 작업을 계속합니다. 이렇게 하면 서버의 스레드 풀이 소진되어 서버가 다른 사용자에게 응답할...

shadow

shadow-rs 🦀 shadow-rs は Rust で書かれた Windows カーネルルートキットであり、Rust の安全性とパフォーマンスの特性を活用しながら、高度なカーネル操作テクニックを実証します。このプロジェクトは教育および研究目的を意図しています。 目次 お知らせ 機能 インストール 対応プラットフォーム ビルド手順 ドライバ クライアント セットアップ手順 テストモードの有効化 Windbg によるデバッグ サービスの作成/開始 免責事項 shadow-rs への貢献 参考 ライセンス 貢献者 お知らせ !IMPORTANT このプロジェクトは開発中です。 機能 プロ...

advisories

보안 권고 "테스트는 버그의 존재를 증명할 수 있지만, 부재를 증명할 수는 없다." -- Edsger W. Dijkstra 공개 보안 권고 모음. 참고 https://github.com/hnsecurity/vulns https://hnsecurity.it/blog/author/marco-ivaldi/ 보안 권고 Linux CVE-2006-1242. Linux 커널 IP ID 정보 노출 취약점. OpenSSH 2003-01-openssh. OpenSSH/PAM 지연 정보 노출 취약점 CVE-2003-0190...

keystone

Keystone Engine Keystone은 가볍고 다중 플랫폼, 다중 아키텍처를 지원하는 어셈블러 프레임워크입니다. 다음과 같은 비교할 수 없는 기능을 제공합니다: 멀티 아키텍처: Arm, Arm64 AArch64/Armv8, Ethereum Virtual Machine, Hexagon, Mips, PowerPC, RISC-V, Sparc, SystemZ 및 X86 16/32/64비트 포함을 지원합니다. 깔끔하고 단순하며 가볍고 직관적인 아키텍처 중립 API. C/C++ 언어로 구현되었으며, Java, Masm, C,...

faxhell

faxhell "Fax Shell" A Proof-of-Concept bind shell using the Fax service and a DLL hijack based on Ualapi.dll. See our writeup at: https://windows-internals.com/faxing-your-way-to-system/ How to use Build Ualapi.dll and place in c:\windows\system32 Start the Fax service, which will load the DLL an...