mailorder

Mail Order The Nalpeiron Licensing Service NLSSRV32.exe is installed as part of certain software installations to handle privileged software licensing operations. It is paired with a client component filechck.dll which communicates with the service via mailslots hence the name. Calls are performe...

stenographer

Stenographer Overview Stenographer is a full-packet-capture utility for buffering packets to disk for intrusion detection and incident response purposes. It provides a high-performance implementation of NIC-to-disk packet writing, handles deleting those files as disk fills up, and provides method...

herpaderping

Process Herpaderping png.HerpaderpIcon Process Herpaderping is a method of obscuring the intentions of a process by modifying the content on disk after the image has been mapped. This results in curious behavior by security products and the OS itself. !png.mimioogle !gif.SurivDemo Summary...

EATGuard

EATGuard Implementation of an export address table protection mitigation, like Export Address Filtering EAF How It Works This project is composed of three binaries that, when compiled, can be found in EATGuard\bin. They are: 1. EATGuardApplication.exe - "Malicious" application that loads...

S-V-Project-Implementation-of-CVE-2015-3256

CVE-2015-3456 VENOM — QEMU Crash PoC and Analysis This repository contains a reproducible crash/DoS proof-of-concept for CVE-2015-3456 "VENOM" using a vulnerable version of QEMU v2.3.0. The project demonstrates: Guest-controlled writes to the virtual floppy disk controller FDC Triggering the...

CVE-2026-120204

DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to create arbitrary directories via the outputdir parameter. Attackers, including cross-site GET requests from an operator's browser, can write chrome trace files ...

EUVD-2026-114725

DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to create arbitrary directories via the outputdir parameter. Attackers, including cross-site GET requests from an operator's browser, can write chrome trace files ...

CVE-2026-120204 DeepInfer through 0.1.0 Path Traversal via /profile output_dir Parameter

DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to create arbitrary directories via the outputdir parameter. Attackers, including cross-site GET requests from an operator's browser, can write chrome trace files ...

CVE-2020-16938

CVE-2020-16938 CVE-2020-16938 is a vulnerability that allows you to get unrestricted file read capabilities on the entire disk as unprivileged user. The bug was originally found and reported by my friend Jonas. His PoC can be found here. My version of the exploit consists of a bunch of Windows AP...

lehack-2026-challenge

LeHack 2026 Challenge A 3-tier challenge demonstrating impact of direct disk mounting. Challenge Overview Level| Goal| Technique ---|---|--- 1| Access the unencrypted disk| Set boot cmdline to init=/bin/bash in grub 2| Crack vault1 LUKS| Extract header → hashcat → unlock & mount vault 3| Crack...

encrypted-linux-kernel-modules

ELKM: Encrypted Linux x86-64 Loadable Kernel Modules ELKM provides a mechanism to securely transport and load encrypted Loadable Kernel Modules LKM. The aim is to protect kernel-based rootkits and implants against observation by Endpoint Detection and Response EDR software and to neutralize the...

CVE-2019-5420

CVE-2019-5420 CVE-2019-5420 Ruby on Rails For educational purposes only. See Reference for the details. Environment Ruby: 2.6.0p0 Rails: 5.2.2 Run $ docker run --name cve-2019-5420 --rm -p 3000:3000 knqyf263/cve-2019-5420 Exploit Execute touch /tmp/rce $ curl...

kali-rpi-luks-crypt

Full disk encryption for Kali on Raspberry or other similar architecture using LUKS This HOWTO is dedicated to running Kali on Raspberry or other similar architecture, e.g. ODROID-C2 using full disk encryption with LUKS. Based on the little bit outdated document here. Motivation Deploying Kali on...

santa

Santa !NOTE As of 2025, Santa is no longer maintained by Google. We encourage existing users to migrate to an actively maintained fork of Santa, such as https://github.com/northpolesec/santa. Santa is a binary and file access authorization system for macOS. It consists of a system extension that...

CLEANSTART-2024-DP84679 Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE

Security vulnerability affects the xen package. Linux disk/nic frontends data leaks This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE...

inception

Note: This tool is no longer under active development, please look at PCILeech instead. INCEPTION Inception is a physical memory manipulation and hacking tool exploiting PCI-based DMA. The tool can attack over FireWire, Thunderbolt, ExpressCard, PC Card and any other PCI/PCIe HW interfaces...

usbkill

« usbkill » is an anti-forensic kill-switch that waits for a change on your USB ports and then immediately shuts down your computer. To run: sudo python usbkill.py or sudo python3 usbkill.py Related project; same idea, but implemented as a Linux driver: https://github.com/NateBrune/silk-guardian...

Centry

Centry WARNING: THIS IS EXPERIMENTAL SOFTWARE. IT IS LIKELY TO CONTAIN BUGS. Updates If you have already installed Centry, please run git pull to update to the latest version. The latest updates make it much more secure against replay attacks. Introduction Centry is a panic button intended to...

CVE-2021-31728

CVE-2021-31727 and CVE-2021-31728 Public Reference for CVE-2021-31727 Exposes unrestricted disk read/write capabilities. Public Reference for CVE-2021-31728 Exposes arbitrary ring 0 code execution directly. Credit Lima X helped with SystemBigPoolInformation idea...

diskwalker

Diskwalker a simple script to walk your disk and keep track of interesting sets of files After gaining access to a remote machine during penetration testing, you might want to find interesting configuration files or binaries to attempt a privilege escalation. The script is self contained, and wor...