bluffy

Bluffy 셸코드를 ✨ 다양한 ✨ 형식으로 변환하세요! Bluffy는 셸코드를 실제처럼 보이는 데이터 형식으로 포맷팅하여 안티바이러스 제품을 정적으로 우회하는 실험에 사용된 유틸리티입니다. 0xBoku의 NinjaUUIDRunner와 ChoiSG의 UuidShellcodeExec 같은 개념 증명 도구들이 Bluffy의 초기 아이디어에 영감을 주었습니다. 현재까지 구현된 기능: 1. UUID 2. CLSID 3. SVG 4. CSS 5. CSV 도움말 root@kitploit: $ python3 bluffy.py -h...

CVE-2026-41704

CVE-2026-41704 affects BOSH Director prior to v282.1.12. The issue arises from AgentClient#handle_method handling NATS responses: it may invoke inject_compile_log and format_exception, and the blobstore resource flow calls ResourceManager#get_resource(blob_id) followed by ResourceManager#delete_r...

CVE-2026-41704 Compromised VM can make arbitrary blobstore deletes

AgentClienthandlemethod lines 264-303 processes every NATS reply. It calls injectcompilelog line 273 on every response, which reads response'value''result''compilelogid' line 332-338 and passes it to downloadanddeleteblob. Separately, any response containing 'exception' goes through formatexcepti...

ProjectID is disclosed and can be used for IDOR attack

I find that we click "Settings" button, we can see all the project, even the login user does not belong to the project. Using burpsuit to hijack the reqeust, we can obtain project ids. We can use projectid to perform IDOR attack. 1 create two projects: project1 and project2, and their admin is...