WindowSpy

WindowSpy 👀 WindowSpy is a Cobalt Strike Beacon Object File meant for targetted user surveillance. The goal of this project was to trigger surveillance capabilities only on certain targets, e.g. browser login pages, confidential documents, vpn logins etc. The purpose was to increase stealth durin...

CVE-2021-31956

CVE-2021-31956 pretty stable exploit on win10 20h2 creates new console window so change that if you don't like oh and more importantly, change the createfilea path to an actual writeable directory on disk...

CVE-2019-10779

CVE-2019-10779 GCHQ Stroom is vulnerable to Cross-Site Scripting due to the ability to load the Stroom dashboard on another site and insufficient protection against window event origins...

BITB

BITB Browser templates for Browser In The Browser BITB attack. More information: https://mrd0x.com/browser-in-the-browser-phishing-attack/ Usage Each folder has a index.html file which has 4 variables that must be modified: XX-TITLE-XX - The title that shows up for the page e.g. Sign in to your...

packetStrider

Packet Strider v0.21 Summary packetStrider for SSH is a packet forensics tool that aims to provide valuable insight into the nature of SSH traffic, shining a light into the corners of SSH network traffic where golden nuggets of information previously lay in the dark. The problem that packet strid...

Follina

Follina Notes related to CVE-2022-30190 FOLLINA: CVE-2022-30190 1. Uses Microsoft Support Diagnostic Tool MSDT 2. Exploits diagnostic window opened for Diagnosis and when executed properly, gives reverse shell to attacker. 3. Github: a. https://github.com/JohnHammond/msdt-follina b...

cve-2019-1458_POC

CVE-2019-1458: Going from 'in the wild report' to POC Intro In December Kaspersky published a blogpost about 0day exploit used in the wild. It piqued my interest because although they described how the exploit was working, they didn't provide any POC in their analysis. This is why I decided to tr...

TeamViewer-dumper-in-CPP

TeamViewer-dumper-in-CPP Извлекает ID TeamViewer, пароль и настройки учетной записи из запущенного экземпляра TeamViewer путем перечисления дочерних окон. Компиляция и требования 1. Скомпилируйте с помощью CL 2. cl TeamViewerDump.cpp 3. или с cl TeamViewerDump.cpp /EHsc 4. Требования 5. TeamViewe...

CVE-2019-8014

CVE-2019-8014 的一点简单分析。 包含 Poc 和 exp Shellcode 是弹出计算器 or CMD 窗口，不记得了。 注意： my.7z 是触发漏洞需要的 bmp 图片 ，文件太大了，我压缩了一下。...

CVE-2022-37706-LPE-exploit

CVE-2022-37706 안녕하세요 여러분, 이번에는 제가 Linux의 주요 창 관리자 중 하나인 Enlightenment https://www.enlightenment.org/ 에서 발견한 최신 0-day에 대해 이야기하려고 합니다. 이 0-day는 모든 사용자를 매우 쉽고 즉시 root 권한으로 승격시킵니다. 익스플로잇은 Ubuntu 22.04에서 테스트되었지만, 어떤 배포판에서도 잘 작동할 것입니다. 우선 Enlightenment는 창 관리자, 컴포지터 및 최소 데스크톱입니다. Linux주요 플랫폼, BSD 및 기타 호...

CVE-2024-23997

YANA Notebook PoC CVE-2024-23997 취약점에 대한 개념 증명Proof-of-Concept입니다. 1. 취약점 개요: 취약점 대상: XSS를 통한 로컬 코드 실행 취약점 버전: = 1.0.16 공격 유형: 원격 코드 실행 공격 벡터: 취약점을 악용하려면 Electron 메인 창을 사용하여 HTTP 패킷을 가로채야 합니다. 다음으로, 가로챈 HTML에 악성 스크립트를 주입해야 합니다. Electron이 Yana 노트북의 메인 창을 만들 때 스크립트가 실행되고 OS 명령을 실행할 수 있습니다. 프로그램이 관리...

CVE-2026-89712

In the Linux kernel, the following vulnerability has been resolved: NFSD: restart sscexpireumount walk after dropping nfsdssclock nfsd4sscexpireumount walks nn-nfsdsscmountlist with listforeachentrysafeni, tmp, .... For each expired entry it sets nsuibusy = true, drops nfsdssclock to run mntput o...

CVE-2024-30051

CVE-2024-30051 — Windows DWM Heap Overflow EoP · Master's Thesis Research -orange Heap-based Buffer Overflow in Windows Desktop Window Manager dwmcore.dll Local Privilege Escalation → Integrity Level SYSTEM via DWM process Build target: Windows 11 22H2 10.0.22621.3447 · Patch: KB5037771 Descripti...

CVE-2026-54107

ValidateHwnd가 게이트가 아닐 때: CVE-2026-54107 근본 원인 분석 win32kfull.sys 창 수명 주기 관리의 use-after-free — 제가 어떻게 발견했는지, 어떻게 실재한다고 확신하게 되었는지, 그리고 연구자 관점에서 MSRC 프로세스가 실제로 어떻게 보였는지. 새벽 2시가 다 되어가던 때, 대상 VM이 디버거의 하트비트에 응답하지 않고, 제가 몇 주 동안 도달 가능하다고 주장해 온 바로 그 명령어에서 브레이크에 걸렸습니다. 어서션도, 손상된 풀 중단도 아닌 — 메시지 디스패치 경로에서 다른...

BIT-TOMCAT-2026-65905 Apache Tomcat: Limited replay attack possible with DIGEST authentication

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while...

PT-2026-90428

In the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc expire umount walk after dropping nfsd ssc lock nfsd4 ssc expire umount walks nn-nfsd ssc mount list with list for each entry safeni, tmp, .... For each expired entry it sets nsui busy = true, drops nfsd ssc loc...

CVE-2026-3096

The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigating to external destinations. This vulnerability could all...

EUVD-2026-75731

The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigating to external destinations. This vulnerability could all...

CVE-2026-49312

Permission control vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

EUVD-2026-74598

Permission control vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...