LoadReload

LoadReload Cargador de shellcode basado en lo que hice para mi tesis de máster, diseñado para shellcode de Sliver menor a 25MB..... !Note Características: Descifrado Multibyte-XOR del Payload Obtiene el Payload localmente Anti-Emulación mediante la función BusySleep vía KUSERSHAREDDATA Bucle RW-R...

doublepulsar-c2-traffic-decryptor

Autor: Luke Jennings [email protected] - @jukelennings Empresa: Countercept @countercept Sitio web: https://countercept.com Un script de python2 para descifrar el tráfico C2 utilizado por el implante SMB DOUBLEPULSAR desde un archivo PCAP. El cifrado usado es un simple XOR de 4 bytes, que a...

CobaltStrikeParser

CobaltStrikeParser 用于解析 CobaltStrike Beacon 配置的 Python 解析器 描述 使用 parsebeaconconfig.py 解析无阶段 beacon、内存转储或 C2 URL，默认启用 Metasploit 兼容模式（默认 true）。 许多无阶段 beacon 是 PE 文件，其中 beacon 代码本身存储在 .data 段中，并通过 4 字节密钥进行异或加密。 该脚本尝试启发式地查找异或密钥和数据，解密数据并从中解析配置。 此设计也支持作为库使用。 该仓库现在还包括一个小的通信模块（comm.py），可以帮助作为 beacon 与 C...

CVE-2022-1257

CVE-2022-1257 PoC: McAfee Agent Database Credential Harvesting Made by scottk817 This script is a PoC for CVE-2022-1257 , a vulnerability in the McAfee Agent Trellix Agent when working with it's database. The vulnerability allows attackers to retrieve and decrypt credentials from the McAfee Agent...

VULNERAVEL-CVE-2018-14847---CREDENCIAIS-EXTRAIDAS

Herramientas de Pentest — /red Repositorio de scripts para auditoría y pruebas de penetración en redes. Úselo únicamente en dispositivos con autorización formal. CVE-2018-14847 — Extractor de Credenciales de Winbox MikroTik Descripción Explota la vulnerabilidad de lectura de archivo no autenticad...

Webmin_Exploit_reverse_shell

Introducción: El Webmin Exploit es un exploit dirigido al servicio Webmin, que puede ser explotado en versiones antiguas de Webmin. Este exploit utiliza diversas técnicas para ejecutar código malicioso y obtener acceso no autorizado al sistema objetivo. Implica: El uso tanto de código C como...

KPOT-string-decrypter

KPOT-string-decrypter Scripts de Python para IDA que descifran las cadenas del stealer KPOT y las establecen como comentarios junto a la variable que las recibiría durante la ejecución. Funciona de la siguiente manera: Obtiene el offset que se pasa en eax a cualquiera de las funciones de descifra...

MAL-2026-12318 Malicious code in @hoteldev/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bb27849cbb16840b019ef47d6a84627d61eb9d48df28da5a9bc1a208e1ff758 build/index.js appends an evalatob... block after the normal exportStar section that decodes to an import-time loader. The loader resolves a C2 IP by...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Malicious code in theme-color-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7a4ba7e8664b9e1d99c4018963a4731d591653d7f2a9b879ba090e7a7f6e7bd Although the package presents itself as a 'theme color picker', package.json identifies the publisher as analysis-chart.io with repository...

Malicious code in package-uploader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69b86134d9cd019c2d8ad172eed54cd4a48839d69ed2c6af52b79ef5080da765 [email protected] ships an install-hook.js that runs automatically as the npm postinstall script package.json declares "postinstall": "node...

MAL-2026-5790 Malicious code in ldpbootstrap-jquery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcab02ae44d1604b6fa9e80156a8c5882f7a4809470ff59eb6d14db4bf28f91f ldpbootstrap-jquery ships and executes an obfuscated Windows PowerShell payload as part of its documented usage. The package contains...

DuneQuixote campaign targets Middle Eastern entities with “CR4T” malware

Introduction In February 2024, we discovered a new malware campaign targeting government entities in the Middle East. We dubbed it "DuneQuixote"; and our investigation uncovered over 30 DuneQuixote dropper samples actively employed in the campaign. These droppers, which exist in two versions –...