OffensiveRust

OffensiveRust My experiments in weaponizing Rust for implant development and general offensive operations. Table of Contents OffensiveRust Why Rust? Examples in this repo Compiling the examples Compiling the examples in this repo Cross Compiling Optimizing executables for size Pitfalls I found...

CVE-2022-29885

CVE-2022-29885 by 1vere$k Apache Tomcat DoS CVE-2022-29885 Exploit. Denial of Service in EncryptInterceptor Tomcat Cluster. The target machine needs to start the Cluster Nio Receiver. Sending a special TCP packet will cause a Denial of Service to the target. Whether EncryptInterceptor is used or...

autocrack

AUTOCRACK.py This python script is a Hashcat https://hashcat.net wrapper to help automate the cracking process. The script includes multiple functions to select a set of wordlists and rules, as well as the ability to run a bruteforce attack, with custom masks, before the wordlist/rule attacks...

UnhookMe

UnhookMe - Dynamically unhooking imports resolver In the era of intrusive AVs and EDRs that introduce hot-patches to the running processes for their enhanced optics requirements, modern adversaries must have a robust tool to slide through these watchguards. The propsed implementation of dynamic...

CredKing

CredKing Overview Benefits Basic Usage Plugin Usage Gmail Okta Installation Development Plugin specific arguments Overview Easily launch a password spray using AWS Lambda across multiple regions, rotating IP addresses with each request. Brought to you by: Benefits Fully supports all AWS Lambda...

hermit

hermit Hermes Reverse Engineering & Manipulation Interactive Toolkit. hermit inspects, decompiles and structurally patches Hermes bytecode HBC, the format React Native apps ship their JavaScript in. Open an .hbc file, browse its functions, read the decompiled JavaScript, edit instructions, string...

Tunna

Tunna Tunna is a set of tools which will wrap and tunnel any TCP communication over HTTP. It can be used to bypass network restrictions in fully firewalled environments. v1.1 Alpha version | | | || | | | ' | ' \ / | | || || | | | | | | | | | || ,|| ||| ||,| Tunna 0.1, for HTTP tunneling TCP...

Alcatraz

Alcatraz Alcatraz is a x64 binary obfuscator that is able to obfuscate various different pe files including: .exe .dll .sys Overview Alcatraz Requirements Usage Features Obfuscation of immediate moves Control flow flattening ADD mutation Entry-point obfuscation Lea obfuscation Anti disassembly...

Amsi-Bypass-Powershell

Sponsored by Amsi-Bypass-Powershell This repo contains some Antimalware Scan Interface AMSI bypass / avoidance methods i found on different Blog Posts. Most of the scripts are detected by AMSI itself. So you have to find the trigger and change the signature at the part via variable/function...

mimikittenz

mimikittenz mimikittenz is a post-exploitation powershell tool that utilizes the Windows function ReadProcessMemory in order to extract plain-text passwords from various target processes. mimikittenz can also easily extract other kinds of juicy info from target processes using regex patterns...

Conflicker_analysis_scripts

Worm Conflicker Analysis scripts conflickershellcodedecryptor.py - Carries out decryption of the shellcode used by conflicker/netapi worm.It's a one-byte XOR decryptor. The output looks like, 00000170 83 c6 07 e8 18 00 00 00 33 d2 52 52 8b cc 66 c7 |........3.RR..f.| 00000180 01 78 2e 51 ff 77 04...

CVE-2019-19204

CVE-2019-19204 An issue was discovered in Oniguruma 6.x before 6.9.4rc2. In the function fetchintervalquantifier formerly known as fetchrangequantifier in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read. Researcher: ManhND of The Tarantula Team,...

fuzzable

Fuzzable Framework for Automating Fuzzable Target Discovery with Static Analysis Introduction Vulnerability researchers conducting security assessments on software will often harness the capabilities of coverage-guided fuzzing through powerful tools like AFL++ and libFuzzer. This is important as ...

OffensiveVBA

OffensiveVBA In preparation for a VBS AV Evasion Stream/Video I was doing some research for Office Macro code execution methods and evasion techniques. The list got longer and longer and I found no central place for offensive VBA templates - so this repo can be used for such. It is very far away...

Vba2Graph

Vba2Graph A tool for security researchers, who waste their time analyzing malicious Office macros. Generates a VBA call graph, with potential malicious keywords highlighted. Allows for quick analysis of malicous macros, and easy understanding of the execution flow. @MalwareCantFly Features Keywor...

SilentMoonwalk

SilentMoonwalk PoC Implementation of a fully dynamic call stack spoofer TL;DR SilentMoonwalk is a PoC implementation of a fully dynamic call stack spoofer, implementing a technique to remove the original caller from the call stack, using ROP to desynchronize unwinding from control flow. Authors...

CVE-2022-36752

Description for CVE-2022-36752 png2webp v1.0.4 was discovered to contain an out-of-bounds write via the function w2p. This vulnerability is exploitable via a crafted webp file when reversing the format back to png. Reproduction To reproduce the vulnerability, download the vulnerable version of...

CVE-2018-12613

CVE-2018-12613 Modified standalone exploit ported to Python 3. Tested on Python 3.7.3, phpMyAdmin 4.8.1 running on Ubuntu 16.04 Works on Linux only. Original exploit by SSD. All credits to them. Changes made 1. Added function to exit if provided phpMyAdmin username/password is correct 2. Added...

CVE-2026-77205

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The...

CVE-2026-77205 Denial of Service via sending bogus X.509 certificates

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The...