VectorKernel

VectorKernel PoCs for Kernelmode rootkit techniques research or education. Currently focusing on Windows OS. All modules support x64 family 64bit OS only. Environment All modules are tested in Windows 11 x64. To test drivers, following options can be used for the testing machine: 1. Enable Loadin...

DarkWidow

DarkWidow A Customizable Dropper Tool targeting Windows. Honourable Mentions: 1. BlackHat Asia, 2024 - Call For Tools 2. BlackHat USA, 2024 - Call For Tools 3. BlackHat SecTor, 2024 - Call For Tools 4. BlackHat Europe, 2024 - Call For Tools 5. Wild West Hacking Fest 2024 - Arsenal Thanks a lot to...

Sharperner

Sharperner Sharperner is a tool written in CSharp that generate .NET dropper with AES and XOR obfuscated shellcode. Generated executable can possibly bypass signature check but I cant be sure it can bypass heuristic scanning. Features PE binary Process Hollowing PPID Spoofing Random generated AES...

DumpBrowserSecrets

DumpBrowserSecrets Extracts browser-stored data such as refresh tokens, cookies, saved credentials, credit cards, autofill entries, browsing history, and bookmarks from modern Chromium-based and Gecko-based browsers Chrome, Microsoft Edge, Firefox, Opera, Opera GX, and Vivaldi. Quick Links Maldev...

InjectProc

InjectProc Process injection is a very popular method to hide malicious behavior of code and are heavily used by malware authors. There are several techniques, which are commonly used: DLL injection, process replacement a.k.a process hollowing, hook injection and APC injection. Most of them use...

mortar

Mortar Loader Red teaming evasion technique to defeat and divert detection and prevention of security products.Mortar Loader performs encryption and decryption PE/Shellcode inside the memory streams and execute it leveraging several injection techniques . Mortar is able to bypass modern anti-viru...

Agent-Tesla-APC-Injection-Token-Manipulation-Registry-Persistence-Analysis

1. 네이티브 API 및 APC 인젝션 x64dbg 메모리 덤프는 Agent Tesla가 하위 레벨 작업을 위해 네이티브 APINT API 호출을 사용하며, APC비동기 프로시저 호출 인젝션 을 포함함을 보여줍니다. 관찰된 주요 함수: NtQueueApcThread – APC를 통해 대상 스레드에 코드를 주입합니다. NtReadVirtualMemory – 다른 프로세스의 메모리를 읽습니다. NtQuerySystemInformation – 시스템 정보를 수집합니다. NtCreateThreadEx 있을 가능성 높음 – 실행을 위한...

Driver-HideKernelThread-IoCancelIrp

Driver-HideKernelThread-IoCancelIrp 自分のコードではない。保存用のみ https://bbs.pediy.com/thread-272795.htm 原理 スレッドのエントリアドレスをIoCancelIrpに、コンテキストを作成したirpに設定する。 するとスレッドはIoCancelIrpを呼び出す。呼び出されると、IRPをキャンセルする操作を実行する。 これによりIRP-CancelRoutineが呼び出される。したがって、自身のスレッドエントリアドレスをIRP-CancelRoutineに設定するだけでよい。 検出方法は？...

DumpChromeSecrets

!IMPORTANT This project is no longer maintained. Please useDumpBrowserSecrets instead, which supports Chrome, Edge, Brave, Firefox, Opera, Opera GX, and Vivaldi. DumpChromeSecrets Extract data from modern Chrome versions, including refresh tokens, cookies, saved credentials, autofill data, browsi...

VortexCry-Ransomware-Release

VortexCry-Вымогатель VortexCry — это продвинутый вымогатель, который использует многоэтапную инъекцию процессов такую как Process Hollowing и APC Injection и загрузку драйверов ядра через уязвимость CVE-2019-16098. Он способен шифровать файлы, уничтожать функции восстановления системы и требовать...

edrEvasionWorkshop

edrEvasionWorkshop DEF CON 34 및 BSidesLV 2026 에서 발표된 "단계별 멀웨어 개발: 로더부터 커널까지 EDR 우회" 워크숍 자료입니다. 이 워크숍은 Elastic Defend 를 대상 EDR로 삼아 커스텀 멀웨어 개발, EDR 아키텍처 및 우회, C2 커스터마이징, 커널 수준 기법을 탐구합니다. 단계별 멀웨어 개발: 로더부터 커널까지 EDR 우회 DEF CON 34 및 BSidesLV 2026 워크숍 자료입니다. 자료는 다음 주제를 다룹니다: EDR 아키텍처 APC 인젝션 파이버Fiber 모듈...

CVE-2026-63973

In the Linux kernel, the following vulnerability has been resolved: net: mana: Add NULL guards in teardown path to prevent panic on attach failure When queue allocation fails partway through, the error cleanup frees and NULLs apc-txqp and apc-rxqs. Multiple teardown paths such as manaremove,...

CVE-2026-45313 Sandboxie-Plus: Sandboxie APC Injection Sandbox Escape

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.17.6, GuiServer::WndHookRegisterSlave in Sandboxie/core/svc/GuiServer.cpp stores attacker-supplied hthread and hproc fields from a GUIWNDHOOKREGISTER request without validating that the thread belongs to the...

CVE-2026-45313

Summary: Sandboxie-Plus on Windows contains a local privilege escalation in GuiServer.cpp prior to v1.17.6. The GuiServer::WndHookRegisterSlave handler stores attacker-supplied hthread and hproc from GUI_WND_HOOK_REGISTER without validating thread belonging to the sandbox or the function pointer’...

CVE-2026-33633

A flaw was found in Kitty, a cross-platform GPU based terminal. A remote attacker, by sending a specially crafted APC graphics protocol command with a large PNG payload to the terminal's standard input stdin, could trigger a heap buffer overflow in the loadimagedata function. This vulnerability...

UBUNTU-CVE-2026-33633

Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in loadimagedata that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG...

CVE-2026-33633

Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in loadimagedata that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG...

CVE-2026-33633

Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in loadimagedata that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG...

KiTTY 安全漏洞

KiTTY is a lightweight telnet and Windows SSH client. Kitty versions 0.46.2 and earlier have a security vulnerability caused by a heap buffer overflow in loadimagedata. This vulnerability allows processes that write to the terminal stdin to trigger a crash through the APC graphical protocol...

PT-2026-41985

Name of the Vulnerable Software and Affected Versions Kitty versions prior to 0.47.0 Description A heap buffer overflow exists in the load image data function. This occurs when a process writes to the terminal's stdin using a single APC graphics protocol command with a PNG format declaration f=10...