msidump

msidump MSI Dump - 악성 MSI 설치 패키지를 분석하고, 파일, 스트림, 바이너리 데이터를 추출하며 YARA 스캐너를 통합하는 도구입니다. 매크로가 활성화된 Office 문서의 경우 oletools mraptor를 빠르게 사용하여 문서의 악성 여부를 판단할 수 있습니다. 더 자세히 분석하려면 oletools olevba나 oledump를 사용할 수 있습니다. 악성 MSI 파일을 분석하기 위해 지금까지는 신뢰할 수 있는 유일한 도구인 lessmsi가 있었습니다. 하지만 lessmsi는 제가 찾던 기능을 구현하지...

xurlfind3r

xurlfind3r xurlfind3r is a command-line utility designed to discover URLs for a given domain in a simple, efficient way. It works by gathering information from a variety of passive sources, meaning it doesn't interact directly with the target but instead gathers data that is already publicly...

unblob

unblob 정확하고 빠르며 사용하기 쉬운 바이너리 블롭 추출 제품군. unblob은 알 수 없는 바이너리 블롭에서 78개 이상의 아카이브, 압축, 파일 시스템 포맷 을 파싱하고, 콘텐츠를 재귀적으로 추출하며, 알 수 없는 청크를 조각냅니다. 펌웨어 이미지를 추출, 분석 및 리버스 엔지니어링하기 위한 완벽한 도구입니다. 데모 기능 78개 이상의 지원 포맷 — SquashFS, JFFS2, UBI/UBIFS, ext, CPIO, ZIP, 7-Zip, gzip, XZ, LZMA, LZ4 등 아카이브, 압축 스트림, 파일 시스템을...

polypyus

Polypyus Firmware Historian Polypyus learns to locate functions in raw binaries by extracting known functions from similar binaries. Thus, it is a firmware historian. Polypyus works without disassembling these binaries, which is an advantage for binaries that are complex to disassemble and where...

Arlo

Arlo Arlo 덤프 및 업데이트에서 실행 가능한 바이너리 추출 블로그 포스트 참조: https://www.synacktiv.com/publications/arlo-im-watching-you 파서 arlo.py는 Flash 메모리 덤프를 파싱하고, 업데이트를 다운로드 및 파싱하거나 알려진 모델을 나열하는 데 사용됩니다. cryptography, asn1crypto, requests pip 패키지가 필요하며 선택적으로 fastcrc 패키지를 사용합니다. 알려진 모델 $ arlo.py list - Cameras - VMC303...

bin2shell

bin2shell bin2shell은 바이너리 파일에서 셸 코드를 추출하기 위한 아주 작은 유틸리티입니다. bash bin2shell.sh additionNum \x45\x6e\x74\x65\x72\x20\x4e\x75\x6d\x62\x65\x72\x20\x31\x20\x3a\x20\x45\x6e\x74\x65\x72\x20\x4e\x75\x6d 감사합니다 TOUHID SHAIKH...

CVE-2026-50226

Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers. This allows unauthorized actors to list catalog items and extract protected binaries from pre-signed cloud links...

CVE-2026-50226

CVE-2026-50226 affects the AcerConnect OTA application. The issue arises from fixed AES-128-CBC keys inside the app, allowing attackers to forge authorization credentials for arbitrary IMEI numbers. This enables unauthorized actors to list catalog items and extract protected binaries from pre-sig...

EUVD-2026-34231

Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers. This allows unauthorized actors to list catalog items and extract protected binaries from pre-signed cloud links...

CVE-2026-50226: Use of Hard-coded Cryptographic Key

Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers. This allows unauthorized actors to list catalog items and extract protected binaries from pre-signed cloud links...

Malicious code in lyrox (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a758a1be229d0656a639cd9e76cb14b3224260a08da87b6de28ff2bc4c1d48ba Heavy obfuscate code for extracting further obfuscate binaries and executing them using file less techniques. Some versions contain the executable embedded,...

EUVD-2021-24913

Malware in sbrugna...

EUVD-2017-11887

Malware in sbrugna...

EUVD-2017-17188

Malware in sbrugna...

Exploit for CVE-2025-26244

CVE-2025-26244-POC The code to exploit this vulnerability can...

Elink Smart eSmartCam Security Vulnerability

Elink Smart eSmartCam is a smart camera from Elink Smart. A security vulnerability exists in Elink Smart eSmartCam version 2.1.5, which stems from a vulnerability that allows an attacker to extract hard-coded AES encryption keys from a binary file...

CVE-2021-38461

The affected product uses a hard-coded blowfish key for encryption/decryption processes. The key can be easily extracted from binaries...

Hardcoded credentials

The affected product uses a hard-coded blowfish key for encryption/decryption processes. The key can be easily extracted from binaries...

Design/Logic Flaw

An attacker with physical access to the device can extract the binary that checks for the hardware key and reverse engineer it, which could be used to create a physical duplicate of a valid hardware key. The hardware key allows access to special settings when inserted...

CVE-2021-38394 Missing Protection against Hardware Reverse Engineering Using Integrated Circuit Imaging Techniques for Boston Scientific Zoom Latitude

An attacker with physical access to the device can extract the binary that checks for the hardware key and reverse engineer it, which could be used to create a physical duplicate of a valid hardware key. The hardware key allows access to special settings when inserted...