CVE-2025-48384

Overview of CVE-2025-48384 CVE-2025-48384 is a critical vulnerability in Git, the widely used distributed version control system. It involves improper handling of carriage return CR characters in configuration values, which can lead to path traversal issues during submodule checkouts. This flaw...

smoke_conf_extract

Smoke Config Extraction Overview This project aims to extrct configurations from smokeloader samples starting at the initial stage. I was set on doing this statically so had to rely on things like Unicorn to bypass some of the more complicated components. Regardless of how this extraction works f...

ThreatResearch

Config Extractors Some used scripts by our team to extract configs from some analyzed samples. PlugX Remcos templateX RedLine Stealer...

CVE-2025-34171

CVE-2025-34171: Unauthenticated File and Debug Data Exposure in CasaOS Vulnerability Overview Field| Value ---|--- CVE ID| CVE-2025-34171 Affects| CasaOS ≤ 0.4.15 Fixed in| No Patch Available Severity| Medium CVSS 4.0| CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CWE| CWE-862:...

ActiveMQ-RCE-Exploit

ActiveMQ-Exploit English | Simplified Chinese CVE-2023-46604 ActiveMQ RCE 5.18.3 Exploit No outbound network exploit Supports JDK 1.8 runtime; automatically checks if target version is within the vulnerability scope Supports exploiting no-outbound targets using Shiro INI configuration to achieve...

EUVD-2026-87365

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...

CVE-2022-23642

PoC for Sourcegraph Gitserver 3.37.0 RCE CVE-2022-23642 Sourcegraph prior to 3.37.0 has a remote code execution vulnerability on its gitserver service. This is due to lack of restriction on git config execution thus "core.sshCommand" can be passed on the HTTP arguments which can contain arbitrary...

bluez

BlueZ - Linux用Bluetoothプロトコルスタック Copyright C 2000-2001 Qualcomm Incorporated Copyright C 2002-2003 Maxim Krasnyansky [email protected] Copyright C 2002-2010 Marcel Holtmann [email protected] コンパイルとインストール Bluetoothユーティリティをコンパイルするには、以下のソフトウェアパッケージが必要です: - GCCコンパイラ - GLibライブラリ -...

CVE-2026-100418 Flame through 2.4.0 Information Exposure via GET /api/config

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...

CVE-2026-100418

The software Flame through 2.4.0 contains an information exposure vulnerability within the unauthenticated GET /api/config endpoint. The root cause is a lack of field redaction, allowing the endpoint to return the entire configuration object. Attackers can send a single unauthenticated request to...

raccoon_config

raccoonconfig Scans a list of raccoon servers from Tria.ge and extracts the config as JSON. If you like, it can also automatically send follow-up malware extracted from the Raccoon config to Tria.ge API key required Resources: Logo: https://www.deviantart.com/snatti89/art/193-365-Mugshot-58870035...

CVE-2026-37072

CVE-2026-37072 Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php An unauthenticated attacker can exploit a Local File Inclusion vulnerability in the 'lang' GET parameter. By sending a specially crafted POST request with t...

Config-Extractors

Malwares Decryptors...

Asyncrat-Venom-Dcrat-Config-Extractor

Asyncrat-Venom-Dcrat-Config-Extractor Static Config Extractor for Asyncrat/Dcrat/VenomRat Utilises dnlib to locate encrypted Config data and associated Encryption values. Values are decrypted in the script without emulating or executing malware code Assumes config lies under the Client.Settings...

AgentTesla-Config-Extractor

AgentTesla-Config-Extractor Config extractor for AgentTesla - Discord/Telegram Variant Usage agenttesla-config-extractor.py -f Example Output Example Hashes root@kitploit: 0de25252f312735c0a26f7ac7a27cc8a51bfcdd900fc2e8d0a8b65013988e7e9...

scavenger_scanner

CVE-2025-54313 IOC Scanner Cross-platform scanners for detecting Indicators of Compromise IOCs related to the eslint-config-prettier supply chain attack CVE-2025-54313. On July 18, 2025, several popular npm packages were compromised through a phishing attack. The attacker gained access to the...

CVE-2017-7921

CVE-2017-7921 exploit This script allows interaction with a CVE-2017-7921 vulnerable camera to perform the following operations: 1. Download and decrypt a configuration file, containing the camera's admin's password. 2. Continuously download images every second. 3. Convert a series of downloaded...

HikvisionExploiter_fixed

HikvisionExploiter Educational security tool for testing unsecured Hikvision exposures and checking CVE-2021-36260 in authorized environments. ⚠️ Legal and Ethical Warning This project should be used only on systems you own or have explicit permission to test. Scanning/exploitation without...

CVE-2026-97993

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking it, so on failure the field briefly holds an ERRPTR: ctx = fd ==...

AZL-104534 CVE-2026-97993 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking it, so on failure the field briefly holds an ERRPTR: ctx = fd ==...