CVE-2022-1257

CVE-2022-1257 PoC: McAfee 에이전트 데이터베이스 자격 증명 탈취 scottk817 제작 이 스크립트는 McAfee 에이전트Trellix 에이전트가 데이터베이스를 사용할 때 발생하는 취약점인 CVE-2022-1257 에 대한 PoC입니다. 이 취약점은 부적절한 암호화 키 처리로 인해 공격자가 McAfee 에이전트 데이터베이스 파일ma.db에서 자격 증명을 추출하고 복호화할 수 있게 합니다. 면책 조항 이 스크립트는 교육 목적으로만 제작되었습니다. 소유하지 않았거나 테스트에 대한 명시적 허가를 받지 않은...

CobaltStrikeParser

CobaltStrikeParser Analyseur Python pour la configuration du Beacon CobaltStrike Description Utilisez parsebeaconconfig.py pour les beacons sans stage, les dumps mémoire ou les URLs C2 avec le mode de compatibilité metasploit vrai par défaut. De nombreux beacons sans stage sont des PE où le code ...

doublepulsar-c2-traffic-decryptor

저자: Luke Jennings [email protected] - @jukelennings 회사: Countercept @countercept 웹사이트: https://countercept.com PCAP 파일에서 DOUBLEPULSAR SMB 임플란트가 사용하는 C2 트래픽을 복호화하는 python2 스크립트입니다. 사용되는 암호화는 간단한 4바이트 XOR로, FUZZBUNCH 툴셋의 명령 출력에서 자주 볼 수 있습니다. 이 스크립트는 첫 번째 비-핑non-ping 패킷의 SESSIONSETUP 매개변수에 연속된...

LoadReload

LoadReload Shellcodeローダー（私が修士論文で行った研究に基づく）、Sliver-Shellcode（25MB未満....）向けに設計されています。 !Note 機能: ペイロードのMultibyte-XOR復号 ペイロードをローカルから取得 KUSERSHAREDDATAを介したBusySleep関数によるアンチエミュレーション EDR無効化 / メモリスキャナのリソース浪費のためのRW-RXループ 「Network Module from Stomped Module」などの動作アラートに対するNetwork-DLLのプリロード...

VULNERAVEL-CVE-2018-14847---CREDENCIAIS-EXTRAIDAS

Outils de Pentest — /rede Dépôt de scripts pour l'audit et les tests d'intrusion réseau. Utilisez uniquement sur des appareils avec autorisation formelle. CVE-2018-14847 — MikroTik Winbox Credential Extractor Description Exploite la vulnérabilité de lecture de fichier non authentifiée dans le...

Webmin_Exploit_reverse_shell

はじめに: Webmin Exploitは、Webminサービスの旧バージョンで悪用可能な、標的型のエクスプロイトです。このエクスプロイトは、悪意のあるコードを実行し、標的システムへの不正アクセスを得るために、さまざまな技術を使用します。 これには以下が含まれます: C言語とアセンブリコードの両方を使用して、標的システム上でコマンドを実行します。 アンチデバッグ、XOR復号、execveやprctlなどのシステムコールを利用して、リバースシェルを起動します。 特徴: アンチデバッグ: ptraceシステムコールを使用して、エクスプロイトのデバッグを防止します。 XOR復号:...

KPOT-string-decrypter

KPOT-string-decrypter Scripts Python pour IDA permettant de déchiffrer les chaînes du voleur stealer KPOT et de les définir comme commentaires à côté de la variable qui les recevra lors de l'exécution. Fonctionnement : Récupère l'offset passé dans eax à l'une ou l'autre fonction de déchiffrement ...

MAL-2026-12318 Malicious code in @hoteldev/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bb27849cbb16840b019ef47d6a84627d61eb9d48df28da5a9bc1a208e1ff758 build/index.js appends an evalatob... block after the normal exportStar section that decodes to an import-time loader. The loader resolves a C2 IP by...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Malicious code in theme-color-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7a4ba7e8664b9e1d99c4018963a4731d591653d7f2a9b879ba090e7a7f6e7bd Although the package presents itself as a 'theme color picker', package.json identifies the publisher as analysis-chart.io with repository...

Malicious code in package-uploader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69b86134d9cd019c2d8ad172eed54cd4a48839d69ed2c6af52b79ef5080da765 [email protected] ships an install-hook.js that runs automatically as the npm postinstall script package.json declares "postinstall": "node...

MAL-2026-5790 Malicious code in ldpbootstrap-jquery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcab02ae44d1604b6fa9e80156a8c5882f7a4809470ff59eb6d14db4bf28f91f ldpbootstrap-jquery ships and executes an obfuscated Windows PowerShell payload as part of its documented usage. The package contains...

DuneQuixote campaign targets Middle Eastern entities with “CR4T” malware

Introduction In February 2024, we discovered a new malware campaign targeting government entities in the Middle East. We dubbed it "DuneQuixote"; and our investigation uncovered over 30 DuneQuixote dropper samples actively employed in the campaign. These droppers, which exist in two versions –...