dll-injector

소개 이름에서 알 수 있듯이, 이 애플리케이션은 주로 Windows에서 실행 중인 모든 프로세스에 DLL을 인젝션하는 기능을 수행합니다. 이 기능을 통해 DLL 로드, DLL 언로드, 주요 WinAPI 함수예: CreateFileW, ReadFile 등 후킹과 같은 여러 작업을 프로세스에 수행할 수 있습니다. 프론트엔드는 Flutter 로 구축되었으며, 핵심 기능은 C++을 사용하여 수행됩니다. 이 프로젝트는 Windows 프로세스의 디버깅 및 동작 수정을 위한 단순화되고 효과적인 도구의 부족을 해소합니다. 현재 도구들은...

MemITM

What's the MemITM tool? The MemITM Mem In The Middle tool has been developped in order to easily intercept "messages" in Windows processes memory. We developped a lot of custom memory interception tools in order to capture network messages before encryption, or IPC messages, and to be able to...

Java-Shellcode-Loader

Java ShellCode Loader Java 기반 ShellCode 로더로, 32비트 및 64비트 플랫폼을 지원합니다. 핵심 원리는 Jna를 이용하여 Windows API를 호출함으로써 shellcode 주입을 구현하는 것입니다. 실행 환경: Jre = 1.5 참고: 이 프로젝트는 이미 yzddmr6/As-Exploits의 ShellCodeLoader 모듈에 내장되어 있습니다. 컴파일 maven package 사용 기본적으로 32비트 프로세스에 무작위로 주입하므로 32비트 shellcode를 사용하십시오. java -jar...

TangledWinExec

Tangled WinExec 이 저장소는 Windows 프로세스 실행 기법을 조사하기 위해 만들어졌습니다. 대부분의 PoC는 기법에 대응하는 이름으로 명명됩니다. 프로젝트 BlockingDLL : 이 도구 모음은 DLL 차단Blocking DLL 프로세스를 테스트하기 위한 것입니다. README.md를 참조하십시오. CloneProcess : 이 디렉터리는 프로세스 포킹forking과 리플렉션reflection을 위한 것입니다. README.md를 참조하십시오. CommandLineSpoofing : 이 PoC는 명령줄...

PR0CESS

PR0CESS Windows 프로세스에 관한 몇 가지 가젯과 즉시 사용 가능한 도구들 :...

DetectWindowsCopyOnWriteForAPI

Windows 공격 헤더 헌팅용 프로세스 속성 열거 도구 배경 이 도구들의 목적은 위협 행위자가 사용하는 프로세스 인젝션 트레이드크래프트 탐지를 지원하는 Windows 프로세스 속성을 열거하는 것입니다. 도구 d-cow - 공유 Windows API예: EtwEventWrite의 인메모리 패칭 탐지를 위한 Windows COWCopy on Write 탐지기 d-criticalsections - Windows 프로세스가 보유한 임계 섹션critical section 수를 열거합니다 d-dr-registers - 하드웨어 중단점을...

CVE-2026-48770

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in the same interactive Windows session can send a malformed WMCOPYDATA message to Notepad++ using the COPYDATAFULLCMDLINE path. The handler appears to process COPYDATASTRUCT.lpData as an unbounded...

ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures

Cybersecurity researchers have flagged multiple ClickFix campaigns that deliver three malware loaders called BabaDeda Loader , Lorem Ipsum Loader , and Potemkin , per independent reports from Morphisec, BlueVoyant, and Huntress, respectively. Attacks involving BabaDeda Loader, observed in April...

CVE-2026-6787

The CVE-2026-6787 issue affects WatchGuard Agent on Windows prior to version 1.25.03.0000. It is a local, low-privilege vulnerability caused by a hard-coded cryptographic key that allows inclusion of code into an existing process, with high impact to confidentiality, integrity, and availability. ...

EUVD-2019-3546

Malware in sbrugna...

EUVD-2024-3302

Malicious code in bioql PyPI...

Tenable Security Center Multiple Vulnerabilities (TNS-2025-20)

According to its self-reported version, the Tenable Security Center running on the remote host is version 6.6.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2025-20 advisory. - Symphony process is a module for the Symphony PHP framework which executes commands ...

About Elevation of Privilege – Windows Process Activation (CVE-2025-21204) vulnerability

About Elevation of Privilege - Windows Process Activation CVE-2025-21204 vulnerability. This vulnerability from the April Microsoft Patch Tuesday was not highlighted by VM vendors in their reviews. It affects the Windows Update Stack component and is related to improper link resolution before fil...

AMD Graphics Driver 输入验证错误漏洞

AMD Graphics Driver is an integrated graphics driver from UltraMicroelectronics AMD. AMD Graphics Driver suffers from an input validation error vulnerability that stems from incorrect input validation could allow an attacker to provide the Windows® system process ID to the kernel-mode driver, whi...

CVE-2025-24483

NULL pointer dereference vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker provides specially crafted data to the specific process of the Windows system where the product is running, the system may cause a Blue Screen of Death BSOD, and as a result,...

SUSE-SU-2023:3899-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.3.0 ESR MFSA 2023-42, bsc1215575: Security fixes: - CVE-2023-5168: Out-of-bounds write in FilterNodeD2D1 bmo1846683. - CVE-2023-5169: Out-of-bounds write in PathOps bmo1846685. - CVE-2023-517...

CVE-2023-5174

If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. This bug only affects Firefox on Windows when run in non-standard configurations such as using runas...

CVE-2023-29353

Sysinternals Process Monitor for Windows Denial of Service Vulnerability...

FormBook Malware Spreads via Malvertising Using MalVirt Loader to Evade Detection

An ongoing malvertising campaign is being used to distribute virtualized .NET loaders that are designed to deploy the FormBook information-stealing malware. "The loaders, dubbed MalVirt, use obfuscated virtualization for anti-analysis and evasion along with the Windows Process Explorer driver for...

MalVirt: .NET Malware Loaders Spread through Malvertising Attacks

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary MalVirt is a cluster of virtualized .NET malware loaders are distributed through malvertising attacks that use obfuscated virtualization and the Windows Process Explorer driver to evade anti-analysis and...