Advanced-Loader-Reverse-Engineering

从Shellhost到3个DLL：分析一个包含载荷注入、CFG绕过和降级攻击的高级加载器 概述 本分析涵盖了一个复杂的多阶段加载器，其目标为 Shellhost.exe、amsi.dll、mstscax.dll 和 clbcatq.dll。该加载器使用了模块践踏、CFG绕过、COM劫持和降级攻击。 Shellhost – 载荷注入的主要目标 该加载器将 Shellhost.exe 作为载荷注入的主要进程。它通过模块践踏 覆盖 Shellhost 的合法代码，植入自身恶意载荷。 关键观察 混淆载荷： 注入代码中包含 ASCII 残留（push 70207369h = "is...

-CVE-2018-0834-aab-aar

Reconocimiento a @reubensammut, eres una bestia, G. CVE-2018-0834 ejecución completa de código. incluye offsets estáticos, bypasses de cfg,dep,aslr : disfruta...

Microsoft Internet Explorer 11 and WPAD service 'Jscript.dll' - Use-After-Free

Exploit Title: Microsoft Internet Explorer 8/11 and WPAD service 'Jscript.dll' - Use-After-Free Date: 2021-05-04 Exploit Author: deadlock Forrest Orr Vendor Homepage: https://www.microsoft.com/ Software Link: https://www.microsoft.com/en-gb/download/internet-explorer.aspx Versions: IE 8-11 64-bit...

Microsoft Edge Chakra CFG Bypass With leafInterpreterFrame Vulnerability

Chakra suffers from a CFG bypass with leafInterpreterFrame. Every JavaScript variable in Chakra except a tagged int is a pointer. From this pointer, using an arbitrary read, it is possible to follow a chain of pointers and end up with a pointer to the native stack. This allows disclosing the stac...

Microsoft Edge Chakra CFG Bypass Due To Bug In ServerFreeAllocation Vulnerability

Charka suffers from a CFG bypass due to a bug in ServerFreeAllocation. Chakra: CFG bypass due to a bug in ServerFreeAllocation CVE-2017-11874 Chakra JIT server exposes a ServerFreeAllocation method that can be used to free an existing JIT allocation for example when the corresponding function get...