NimicStack

NimicStack NimicStack es la implementación pura en Nim de la técnica de Call Stack Spoofing para imitar programas legítimos. Todo el proyecto se basa en la PoC compartida por WithSecure Labs Compilación Puedes compilar directamente el código fuente con el siguiente comando: nim c -d=mingw...

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

moneta

/ \ / | / \ / \ / \ / / \ \ / Y | \ /| | / | //| | / | / / / / / Moneta v1.0 | Forrest Orr | 2020 REQUIRED -m |region|referenced|ioc -p |PID OPTIONAL -v detail|debug|surface -d --option from-base|statistics --filter unsigned-module|clr-prvx|clr-heap|metadata-modules --address --region-size -m...

LazyHook

Resumen LazyHook es un framework sigiloso de hooking de API que evita los sistemas de prevención de intrusiones de host HIPS mediante la suplantación de la pila de llamadas. Al aprovechar los puntos de interrupción de hardware a nivel de CPU y el manejo de excepciones vectorizadas, ejecuta código...

Shelter

Shelter Shelter 是一种完全武器化的睡眠混淆技术，它通过广泛使用 ROP 来实现内存中 payload 的完全加密。 该 crate 具有以下特点： AES-128 加密。 完整 PE 加密能力。 在睡眠期间移除执行权限。 不使用 APC/HWBP/定时器，仅使用 ROP 实现混淆。 使用 Unwinder 在执行 ROP 链之前实现调用栈欺骗。 提供不同的执行方式以适应各种情况。 其他 OPSEC 考虑：DInvokers、间接系统调用、字符串字面量加密等。 内容 用法 示例 fluctuate fluctuatefromaddress...

SilentMoonwalk

SilentMoonwalk 完全动态调用栈欺骗器的 PoC 实现 概要 SilentMoonwalk 是一个完全动态调用栈欺骗器的 PoC 实现，它实现了一种技术，用于从调用栈中移除原始调用者， 并使用 ROP 使栈展开与控制流不同步。 作者 本 PoC 是有关栈欺骗主题的联合研究成果。该研究的作者是： KlezVirus Waldo-IRC Trickster0 我想强调，如果没有 Waldo-IRC 和 Trickster0 的工作，这项工作将不可能完成，他们两人都 为 PoC 的早期阶段以及背后的研究做出了贡献。 概述 该仓库演示了一个 PoC 实现，用于在调用任意 Window...

ThreadStackSpoofer

线程栈欺骗 / 调用栈欺骗概念验证 一种高级内存驻留规避技术的概念验证实现，用于欺骗线程调用栈。该技术可绕过基于线程的内存检查规则，在进程内存中更好地隐藏 shellcode。 简介 本示例实现了 线程栈欺骗 技术，旨在规避恶意软件分析师、AV 和 EDR 通过检查线程调用栈中 shellcode 帧的引用。其核心思路是隐藏线程调用栈中指向 shellcode 的引用，从而伪装包含恶意代码的内存分配。 本实现与我的 ShellcodeFluctuation 一起，为红队工具提供了与商业 C2 产品相媲美的示例，让我们在红队工具中不落下风。💪 实现已变更...

CallStackSpoofer

CallStackSpoofer Este repositorio demuestra una implementación de PoC para suplantar pilas de llamadas arbitrarias al realizar llamadas al sistema. Para una guía técnica completa, consulta la entrada de blog que acompaña a este repositorio aquí:...

Unwinder

Contenido SilentMoonWalk Descripción Créditos Uso Macro callfunction! Macro indirectsyscall! Paso de parámetros Ejemplos Llamando a kernel32.dll!Sleep Llamando a kernel32.dll!OpenProcess Llamando a NtDelayExecution como syscall indirecto Concatenar llamadas a macros Consideraciones Frame inicial...

CallStackMasker

CallStackMasker Este repositorio demuestra una técnica de prueba de concepto PoC para suplantar dinámicamente pilas de llamadas mediante temporizadores. Antes de que nuestro implante entre en suspensión, podemos poner en cola temporizadores para sobrescribir su pila de llamadas con una falsa y...

MassDriver

MassDriver Proxy de llamadas API sensibles desde shellcode a artefacto para pilas de llamadas limpias compatibles con CET. PoC complementario de mi publicación en el blog: Stop Being Weird — Life After Call Stack Spoofing Under CET. Compilación MinGW no tiene una forma de establecer el indicador ...

CVE-2026-84851

An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service...

CVE-2026-84851

CVE-2026-84851 is an uncontrolled recursion vulnerability in the Ion reader component of Amazon Ion-C , affecting versions before 1.1.6 . A remote, unauthenticated attacker can craft malicious Ion data that exhausts the native call stack, causing a denial of service in any application using the l...

CVE-2026-84851 Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6

An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service...

PT-2026-84881

An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: sched/scs: The task stack state is reset in bringupcpu. When a CPU is hot-plugged, the idle task on that CPU calls several layers of C code before finally leaving the kernel. When KASAN is in use, a “poisoned” shadow is left behi...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: arm64/entry: DAIF was unmasked in cpuswitchto, and called on the irqstack. cpuswitchto and callonirqstack manipulate the SP to switch to different stacks, along with the Shadow Call Stack if it is enabled. These two stack...

EUVD-2026-63468

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values...

protobufjs: protobufjs: Denial of Service via crafted JSON descriptors

A flaw was found in protobufjs. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a crafted JSON descriptor with deeply nested namespace definitions. This can lead to the exhaustion of the JavaScript call stack during descriptor loading, making the...

SUSE CVE-2026-67313

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger...