ExtractUsnJrnl

The change journal on NTFS is a file found at $Extend$UsnJrnl. It is a system metafile that is not possible to find in a normal dir listing, or even posible to by regular means. The relevant data is found in the alternate data stream named $J. There's also another ADS called $Max which is rather...

LAB-DFIR-cve-2023-38831

LAB-DFIR-cve-2023-38831 Este laboratorio simula un ataque CVE-2023-38831 y debe investigar la imagen de disco, conteniendo una variedad de preguntas que incluyen la comprensión del registro de Windows, archivos NTFS, caché del navegador, y un entendimiento completo de las funciones que emanan de...

citrix-2025

Script de detección para dispositivos Citrix NetScaler Autor: NCSC-NL !WARNING Algunos de estos controles están destinados a buscar compromisos, mientras que otros verifican si estás comprometido. Descargo de responsabilidad Estos scripts se proporcionan sin ninguna garantía respecto a su...

vboxdie-cracker

Crackeador de contraseñas de cifrado de imágenes de disco de Virtual Box Requisitos 1. PHP = 5.5.0 2. OpenSSL = 1.0.1 soporte XTS Descripción del algoritmo La contraseña del usuario se almacena usando una combinación de PBKDF2 y AES-XTS de la siguiente manera los valores mostrados están fijos por...

vboxdie-cracker

Virtual Box Disk Image Encryption password cracker Requirements 1. PHP = 5.5.0 2. OpenSSL = 1.0.1 XTS support Algorithm description User password is stored using a combination of PBKDF2 and AES-XTS as following shown values are fixed at the moment, but they can be controlled inside the file forma...

libewf

libewf는 Expert Witness Compression Format EWF에 접근하기 위한 라이브러리입니다. 프로젝트 정보: 상태: 실험적 라이선스: LGPL-3.0-or-later 읽기 또는 쓰기 지원 EWF 형식: SMART .s01 EWF-S01 EnCase .E01 EWF-E01 .Ex01 EWF2-Ex01 지원되지 않음: .Ex01 EWF2-Ex01 bzip2 압축 작업 진행 중 .Ex01 EWF2-Ex01 암호화 읽기 전용 지원 EWF 형식: 논리 증거 파일 LEF .L01 EWF-L01 .Lx01...

Volumiser

Volumiser Introduction Volumiser is a command line tool and interactive console GUI for listing, browsing and extracting files from common virtual machine hard disk image formats. The tool was written to combat a regular problem where massive 100G+ disk images are often hard to work with or...

CVE-2026-89492

A flaw was found in the Linux kernel's OCFS2 filesystem. A local attacker with the ability to mount a crafted on-disk image could exploit this vulnerability by providing excessive directory-index entry counts when reading metadata. This can lead to an out-of-bounds read, potentially causing...

CVE-2026-89492

CVE-2026-89492 is a slab out-of-bounds read in the Linux kernel's OCFS2 filesystem. The functions ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() fail to bound the ocfs2_dx_entry_list counts against the 4 KB block capacity. As a result, ocfs2_dx_dir_search() can walk up to 0xffff entries pa...

PT-2026-90208

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2 validate dx leaf and ocfs2 validate dx root check the ECC and signature of an indexed-directory block before it reaches higher-level callers, but neither...

CVE-2026-88069 Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...

adiskreader-secretsdump

🚩 Sponsors If you like this project, consider purchasing licenses of OctoPwn, our full pentesting suite that runs in your browser! For notifications on new builds/releases and other info, hop on to our Discord adiskreader-secretsdump Extract registry and NTDS secrets from local or remote disk...

foremost

FOREMOST Foremost는 헤더와 푸터를 기반으로 파일을 복구하는 Linux 프로그램입니다. Foremost는 dd, Safeback, Encase 등에서 생성된 이미지 파일이나 드라이브에서 직접 작동할 수 있습니다. 헤더와 푸터는 구성 파일로 지정되므로 찾고자 하는 헤더를 직접 선택할 수 있습니다. FOREMOST 설치 foremost를 실행하려면 다음을 수행해야 합니다: 아카이브 압축 해제 컴파일 설치 방법은 다음과 같습니다: LINUX: $ tar zxvf foremost-xx.tar.gz $ cd...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nilfs2: A bug in markbufferdirty was fixed, as it sometimes generates a warning due to the forced discard of reused buffers. A syzbot stress test using a corrupted disk image revealed that markbufferdirty called from nilfsmark...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerability has been resolved: nilfs2: A infinite loop has been fixed in nilfsmdtgetblock. If the disk image that nilfs2 mounts is corrupted, and the virtual block address obtained through block lookup for a metadata file is invalid, nilfsbmaplookupatlevel may...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fixed a general protection fault in nilfsbtreeinsert If nilfs2 reads a corrupted disk image and attempts to read a b-tree node by calling nilfsbtreegetblock against an invalid virtual block address, it returns -ENOENT...

CVE-2026-72193

A flaw was found in the Linux kernel's ntfs3 driver. A remote attacker could exploit this by providing a specially crafted NTFS3 disk image, which, when mounted, triggers an in-kernel infinite loop. This can cause the system to hang, leading to a Denial of Service DoS where the system becomes...

CVE-2026-72193

In the Linux kernel, the following vulnerability has been resolved: ntfs3: cap RESTARTTABLE free-chain walker at rt-used A crafted NTFS3 disk image triggers an in-kernel infinite loop at mount time, hanging the mounting thread and firing the soft-lockup watchdog within 22s on multi-CPU hosts pani...

CVE-2026-72193

In the Linux kernel, the following vulnerability has been resolved: ntfs3: cap RESTARTTABLE free-chain walker at rt-used A crafted NTFS3 disk image triggers an in-kernel infinite loop at mount time, hanging the mounting thread and firing the soft-lockup watchdog within 22s on multi-CPU hosts pani...

UBUNTU-CVE-2026-72193

In the Linux kernel, the following vulnerability has been resolved: ntfs3: cap RESTARTTABLE free-chain walker at rt-used A crafted NTFS3 disk image triggers an in-kernel infinite loop at mount time, hanging the mounting thread and firing the soft-lockup watchdog within 22s on multi-CPU hosts pani...