46 matches found
SessionHop
SessionHop SessionHop is a C tool that utilizes the IHxHelpPaneServer COM object, configured to run as an Interactive User, to hijack specified user sessions. By creating a session moniker and utilizing the COM object's Execute interface, operators can run arbitrary files within another user's...
COM-Hunter
COM-Hunter COM Hijacking VOODOO Descripción COM-Hunter es una herramienta de persistencia mediante COM Hijacking. Disponible tanto en una versión .NET como en una variante BOF totalmente compatible con Cobalt Strike. La siguiente lista explica los modos disponibles: Modo Búsqueda : Busca CLSIDs...
WFH
Windows Feature Hunter WFH Windows Feature Hunter WFH is a proof of concept python script that uses Frida, a dynamic instrumentation toolkit, to assist in potentially identifying common “vulnerabilities” or “features” within Windows executables. WFH currently has the capability to automatically...
ContextMenuHijack
ContextMenuHijack This original idea that inspired me is from @NinjaParanoid : ContextMenuHijack is a simple persistence technique that use COM hijacking based on human behavior, when you right click on a file/folder in the File Explorer to open the Context Menu, it executes at the same time the...
invoker
Invoker Utilidad de pruebas de penetración y herramienta de evaluación antivirus. Construido con Visual Studio Community 2022 v17.5.4 64 bits y probado en Windows 10 Enterprise OS 64 bits. Hecho con fines educativos. ¡Espero que sea de ayuda! Este repositorio comenzó a tener firmas conocidas y no...
Spartacus
!CAUTION Este repositorio no tiene mantenimiento, visita https://github.com/sadreck/Spartacus para la versión más reciente. Spartacus: Kit de Secuestro de DLL/COM ¿Por qué "Spartacus"? Si has visto la película Spartacus de 1960, recordarás la escena donde los romanos piden que Spartacus se...
acCOMplice
acCOMplice Your COM hijacking accomplice Author: David Tulis @kafkaesqu3 Overview This repository contains code samples and proofs-of-concept for exploring COM hijacking. COM hijacking is a Windows post exploitation technique, which can be used for persistence or defense evasion. For more...
CVE-2026-66804
CVE-2026-66804: 크로스 디바이스 가상 카메라 EoP 독자적으로 발견하여 현재 CVE-2026-66804로 추적되는 문제를 보고했습니다. MSRC는 이 제출이 동일한 근본 원인Windows Camera FrameServer을 가진 이전 보고의 중복임을 확인했습니다. 일반 Windows 사용자는 C:\ProgramData\CrossDevice 아래에 누락된 신뢰 경로를 만들고, 등록된 Cross Device 가상 카메라 COM DLL을 식재한 다음, Windows Camera Frame Server가 공격자가 제어하는...
Argamal: Malware hidden in hentai games
In April 2026, we discovered a new malware campaign targeting players of "hentai" games. Once launched, the infected games install a previously unknown malicious implant on the user's machine. After a few days, the implant downloads and executes a Trojan, resulting in full system compromise and...
Symantec Endpoint Protection Client < 14.3 RU8 Patch 3 / 14.3 RU9 Patch 2 / 14.3 RU10 Patch 1 Multiple Vulnerabilities (36774)
The version of Symantec Endpoint Protection SEP Client installed on the remote host is affected by a multiple vulnerabilities as referenced in the 36774 advisory. - Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a Elevation of Privile...
CVE-2025-13919
Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hijacking vulnerability, which is a type of issue whereby an attacker attempts to establish persistence and evade detection by hijacking COM references in the Windows Registry...
CVE-2025-13919
Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hijacking vulnerability, which is a type of issue whereby an attacker attempts to establish persistence and evade detection by hijacking COM references in the Windows Registry...
EUVD-2025-206456
Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hijacking vulnerability, which is a type of issue whereby an attacker attempts to establish persistence and evade detection by hijacking COM references in the Windows Registry...
CVE-2025-13919
Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hijacking vulnerability, which is a type of issue whereby an attacker attempts to establish persistence and evade detection by hijacking COM references in the Windows Registry...
CVE-2025-13919 Component Object Model (COM) Hijacking in Symantec Endpoint Protection Windows Client
Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hijacking vulnerability, which is a type of issue whereby an attacker attempts to establish persistence and evade detection by hijacking COM references in the Windows Registry...
CVE-2025-13919
The CVE-2025-13919 entry concerns Symantec Endpoint Protection Client vulnerabilities, specifically a COM Hijacking issue in Windows where references in the COM registry can be hijacked to establish persistence and evade detection. Affected software is SEP Client versions prior to 14.3 RU10 Patch...
PT-2026-5143
Name of the Vulnerable Software and Affected Versions Symantec Endpoint Protection versions prior to 14.3 RU10 Patch 1 Symantec Endpoint Protection versions prior to 14.3 RU9 Patch 2 Symantec Endpoint Protection versions prior to 14.3 RU8 Patch 3 Description The software may be susceptible to a C...
CVE-2025-13919: Uncontrolled Search Path Element
Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hijacking vulnerability, which is a type of issue whereby an attacker attempts to establish persistence and evade detection by hijacking COM references in the Windows Registry...