MemITM

MemITMツールとは？ MemITM（Mem In The Middle）ツールは、Windowsプロセスメモリ内の「メッセージ」を簡単にインターセプトするために開発されました。暗号化前のネットワークメッセージやIPCメッセージをキャプチャし、それらを検査したり、ファジングのために変更したりするために、多くのカスタムメモリインターセプションツールを開発してきました。各ツールは非常にカスタムで汎用性がなく、C/ASMで実装されており、使用・保守・適応が容易ではありませんでした。 MemITMツールはこれらの問題に対処するために開発され、以下で構成されています： IDA...

dll-injector

概要 名前が示すように、このアプリケーションは主にWindows上で実行中の任意のプロセスにDLLを注入します。その力を利用して、DLLの読み込み、アンロード、主要なWinAPI関数（例：CreateFileW、ReadFileなど）のフックなど、プロセスに対する複数の操作を実行できます。 フロントエンドはFlutter...

Java-Shellcode-Loader

Java ShellCode Loader 基于Java实现的ShellCode加载器，兼容32位及64位平台。 核心原理是利用Jna来调用Windows API，实现shellcode的注入。 运行环境：Jre = 1.5 注：本项目已经内置在yzddmr6/As-Exploits的ShellCodeLoader模块中。 编译 maven package 使用 默认会随机注入32位进程，请使用32位的shellcode root@kitploit: java -jar ShellcodeLoader.jar shellcodehex 注入x64位shellcode...

TangledWinExec

Tangled WinExec 此仓库用于研究 Windows 进程执行技术。 大多数 PoC 都按与其对应的技术命名。 项目 BlockingDLL : 该工具集用于测试阻止 DLL 的进程。参见 README.md。 CloneProcess : 此目录用于进程分叉与反射。参见 README.md。 CommandLineSpoofing : 此 PoC 实现命令行欺骗（Command Line Spoofing）。该技术可能不适用于 Windows 11。 DarkLoadLibrary : 此目录中的 PoC 用于测试由 @batsec 发布的 Dark Load...

PR0CESS

PR0CESS 一些关于 Windows 进程的小工具，开箱即用 :...

DetectWindowsCopyOnWriteForAPI

Windows 进程属性枚举工具，用于威胁狩猎 背景 这些工具的目的是枚举 Windows 进程的特征，以支持检测威胁行为体所使用的进程注入技术。 工具 d-cow - Windows 写时复制检测器，用于检测共享 Windows API（例如 EtwEventWrite）的内存补丁 d-criticalsections - 枚举 Windows 进程拥有的临界区数量 d-dr-registers - 枚举已设置调试寄存器（表示硬件断点）的进程 d-nonmodulecallstack - 枚举所有线程的调用栈及关联模块和函数 d-peb-dll-loadreason - 枚举 DLL...

CVE-2026-48770

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WMCOPYDATA message to Notepad++ using the COPYDATAFULLCMDLINE path. The handler appears to process COPYDATASTRUCT.lpData as an unbounded...

ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures

Cybersecurity researchers have flagged multiple ClickFix campaigns that deliver three malware loaders called BabaDeda Loader , Lorem Ipsum Loader , and Potemkin , per independent reports from Morphisec, BlueVoyant, and Huntress, respectively. Attacks involving BabaDeda Loader, observed in April...

CVE-2026-6787

The CVE-2026-6787 issue affects WatchGuard Agent on Windows prior to version 1.25.03.0000. It is a local, low-privilege vulnerability caused by a hard-coded cryptographic key that allows inclusion of code into an existing process, with high impact to confidentiality, integrity, and availability. ...

EUVD-2019-3546

Malware in sbrugna...

EUVD-2024-3302

Malicious code in bioql PyPI...

Tenable Security Center Multiple Vulnerabilities (TNS-2025-20)

According to its self-reported version, the Tenable Security Center running on the remote host is version 6.6.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2025-20 advisory. - Symphony process is a module for the Symphony PHP framework which executes commands ...

About Elevation of Privilege – Windows Process Activation (CVE-2025-21204) vulnerability

About Elevation of Privilege - Windows Process Activation CVE-2025-21204 vulnerability. This vulnerability from the April Microsoft Patch Tuesday was not highlighted by VM vendors in their reviews. It affects the Windows Update Stack component and is related to improper link resolution before fil...

AMD Graphics Driver 输入验证错误漏洞

AMD Graphics Driver is an integrated graphics driver from UltraMicroelectronics AMD. AMD Graphics Driver suffers from an input validation error vulnerability that stems from incorrect input validation could allow an attacker to provide the Windows® system process ID to the kernel-mode driver, whi...

CVE-2025-24483

NULL pointer dereference vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker provides specially crafted data to the specific process of the Windows system where the product is running, the system may cause a Blue Screen of Death BSOD, and as a result,...

SUSE-SU-2023:3899-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.3.0 ESR MFSA 2023-42, bsc1215575: Security fixes: - CVE-2023-5168: Out-of-bounds write in FilterNodeD2D1 bmo1846683. - CVE-2023-5169: Out-of-bounds write in PathOps bmo1846685. - CVE-2023-517...

CVE-2023-5174

If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. This bug only affects Firefox on Windows when run in non-standard configurations such as using runas...

CVE-2023-29353

Sysinternals Process Monitor for Windows Denial of Service Vulnerability...

FormBook Malware Spreads via Malvertising Using MalVirt Loader to Evade Detection

An ongoing malvertising campaign is being used to distribute virtualized .NET loaders that are designed to deploy the FormBook information-stealing malware. "The loaders, dubbed MalVirt, use obfuscated virtualization for anti-analysis and evasion along with the Windows Process Explorer driver for...

MalVirt: .NET Malware Loaders Spread through Malvertising Attacks

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary MalVirt is a cluster of virtualized .NET malware loaders are distributed through malvertising attacks that use obfuscated virtualization and the Windows Process Explorer driver to evade anti-analysis and...