pybeacon

PyBeacon PyBeacon is a collection of scripts for dealing with Cobalt Strike's encrypted traffic. It can encrypt/decrypt beacon metadata, as well as parse symmetric encrypted taskings Scripts included There is a small library which includes encryption/decoding methods, however some example scripts...

EDRSandblast

EDRSandBlast EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections Notify Routine callbacks, Object Callbacks and ETW TI provider and LSASS protections. Multiple userland unhooking techniques are also implemented to evade userland monitoring. As of...

sRDI

sRDI - Shellcode Reflective DLL Injection sRDI allows for the conversion of DLL files to position independent shellcode. It attempts to be a fully functional PE loader supporting proper section permissions, TLS callbacks, and sanity checks. It can be thought of as a shellcode PE loader strapped t...

unicorn

Unicorn Engine LOOKING FOR CONTRIBUTORS! See this. Unicorn is a lightweight, multi-platform, multi-architecture CPU emulator framework, based on QEMU. Unicorn offers some unparalleled features: Multi-architecture: ARM, ARM64 ARMv8, M68K, MIPS, PowerPC, RISCV, SPARC, S390X, TriCore and X86 16, 32,...

TelemetrySourcerer

Telemetry Sourcerer Introduction Telemetry Sourcerer can enumerate and disable common sources of telemetry used by AV/EDR on Windows. Red teamers and security enthusiasts can use this tool in a lab environment to: Identify collection-based blind spots in the products they're up against. Determine...

instrumentation_callbacks

instrumentationcallbacks Instrumentation callbacks are quite a fun undocumented part of Windows. All the code in this repository is released under the MIT license. This repository uses google style C++ spacing. PRs are welcome if you find issues, bugs, or believe a specific feature should be adde...

DllNotificationInjection

DllNotificationInjection Main Contributors Description DllNotificationInection is a POC of a new “threadless” process injection technique that works by utilizing the concept of DLL Notification Callbacks in local and remote processes. An accompanying blog post with more details is available here:...

CVE-2026-102823

The russh Rust SSH client and server library is vulnerable in versions prior to 0.63.1 due to a flaw in russh/src/client/encrypted.rs. The client_read_authenticated function forwards various channel lifecycle events (such as CHANNEL_DATA, CHANNEL_EOF, and CHANNEL_CLOSE) to public client::Handler ...

erl_mouse

erlmouse version 1.1 Alright, I've improved several things to increase chances of finding a vulnerable device or network. Most are not public facing, have been patched, or are so oscure that it can be difficult to find a target. Nevertheless, we persist. You can now scan every IP address in china...

acheron

About Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentatio...

CVE-2026-98058

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. Certain internal helper functions that pause execution to perform blocking operations were not properly marked as sleepable. A local user with permissions to load BPF programs can invoke these functions within...

CVE-2026-98046

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. The bpfbtffindbynamekind helper function was not properly marked as sleepable capable of pausing execution while waiting for resources, allowing it to be executed in non-sleepable contexts such as timer callbacks. A loca...

CVE-2026-91096

The proxygen library (versions v2024.10.28.00 through v2026.09.28.00 ) contains a vulnerability where WebTransportImpl::terminateSessionStreams (or WebTransportImpl::destroy in releases before v2025.08.18.00 ) fails to unregister read callbacks for streams that are no longer open prior to destruc...

CVE-2026-93809

A flaw was found in the Linux kernel's AMD GPU driver amdgpu. A local user with administrative privileges could cause a Denial of Service DoS by unloading the driver module while callbacks are still scheduled. Because the driver does not wait for pending Read-Copy Update RCU callbacks to complete...

CVE-2018-7600

TRAN CONG DANH - SVTT - Mentor: LUU VAN LAN - CVE-2018-7600 - Day Started: 26/06/2024. Table of contents: 1. CVE summary 2. Prerequisites 3. CVE Analyse 4. Mitigation CVE summary An attacker could call a Drupal Form API Ajax Request containing the calluserfunc auto do function Drupal before 7.58,...

sliver-n8n-notifications

Sliver C2 + n8n Integration Real-time notifications for Sliver C2 implant callbacks via Discord and Slack Overview This project integrates Sliver C2 Command & Control framework with n8n workflow automation to provide real-time notifications when new implant connections are established. When a...

CVE-2011-1237

CVE-2011-1237 This is an old POC for CVE-2011-1237 on Windows 7 written in 2013. The vulnerability was discovered by Tarjei Mandt @kernelpool and explain in his paper Kernel Attacks through User-Mode Callbacks. Several things are hardcoded in this POC and it call the Null page which does not work...

Interceptor

Interceptor Author: @Cerbersec Interceptor is a kernel driver focused on tampering with EDR/AV solutions in kernel space by patching kernel callbacks and hooking IRPs. Interceptor was made as part of an internship at NVISO Security's Red Team. The associated blogposts can be found here kernel...

PE-Obfuscator

PE-Obfuscator PE obfuscator with Evasion in mind , needs Admin Privilege in order to load RTCore64 driver. Video: https://user-images.githubusercontent.com/123980007/234171901-c1eb735e-ceca-481d-9310-02ba30f6836b.mp4 The Obfuscator : - Gets xored Fileless PE from a remote server - Drop the Loader...

AZL-104240 CVE-2026-98121 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix NULL pointer dereference in PM callbacks msc313ewdtprobe doesn't set the driver data for the platform device. As a result, devgetdrvdata in msc313ewdtsuspend and msc313ewdtresume will return NULL, leading t...