drow

drow 描述 太长不看 drow 是一个命令行工具，用于注入代码并钩取 ELF 可执行文件（构建后）的入口点。它接收未经修改的 ELF 可执行文件作为输入，并输出一个包含用户提供的内嵌 payload 的修改版 ELF，该 payload 在运行时执行。 稍微详细一些…… Drow 执行以下步骤来创建新的修补版 ELF： 1. 映射未修改的目标 ELF 可执行文件和用户提供的 payload（一个位置无关的 blob） 2. 通过解析程序头定位第一个可执行段 3. 通过解析节头定位可执行段中的最后一个节 4. 将（段中的）最后一个节的节头 shsize 和程序头...

scenester

Scenester Scenester - una herramienta para capturar visualmente un sitio web proporcionando múltiples user-agents. Diseñada para ayudar en el descubrimiento de diferentes puntos de entrada en una aplicación. Publicado como código abierto por NCC Group Plc - http://www.nccgroup.com/ Desarrollado p...

patchkit

patchkit 使用一个或多个简单 Python 脚本对 ELF 二进制文件进行补丁。 使用方法： root@kitploit: patch 补丁目录|文件... patchdir 包含一个或多个 Python 补丁文件，这些文件将按字母顺序对二进制文件执行。 补丁示例 对地址进行 NOP 填充、注入汇编函数以及挂钩入口点： root@kitploit: def simplepatchpt: 在入口点处 NOP 填充一个跳转指令 pt.patchpt.entry, hex='90' 5 将汇编代码注入到二进制文件中并返回地址 addr = pt.injectasm='mov eax, ...

firstexecution

firstexecution Colección de diferentes formas de ejecutar código fuera de los puntos de entrada esperados...

CVE-2026-46588

camel-couchdb CouchDb Header Injection Reproducer CVE-2026-46588 Este proyecto demuestra una inyección de cabeceras de mensaje en el componente camel-couchdb de Apache Camel, registrada como CVE-2026-46588. El componente lee varias cabeceras de Exchange para controlar su comportamiento —...

CVE-2026-53940 Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation

Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...

DotNET_XorCryptor

DotNET XorCryptor También puedes prestar atención a un proyecto anterior - NET-MalwareCryptor Este es un empaquetador de ejecutables .NET con cifrado de payload. Úselo solo con fines educativos. ¿Cómo usar? --file path - especificar nombre de archivo --flood - añadir clases basura al archivo...

HvLoader

Resumen de HvLoader HvLoader.efi es una aplicación EFI para cargar un cargador de hipervisor externo. HvLoader.efi carga un binario de cargador de hipervisor dado DLL, EFI, etc. y llama a su punto de entrada pasando el ImageHandle de HvLoader.efi. De esta manera, el binario del cargador de...

Astra Linux – Vulnerability in edk2

Existing checks in SmmEntryPoint will not catch underflow when calculating BufferSize...

EulerOS 2.0 SP12 : python-pip (EulerOS-SA-2026-3376)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...

EulerOS Virtualization 2.13.1 : python-pip (EulerOS-SA-2026-3193)

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to t...

Linux Distros Unpatched Vulnerability : CVE-2026-72215

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MIPS: DEC: Ensure 32-bit stack location for o32 promprintf In 64-bit configurations calling any firmware entry points from a kernel thread other than the initia...

PT-2026-71136

In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for...

EulerOS 2.0 SP13 : python-pip (EulerOS-SA-2026-2993)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...

CVE-2026-47425

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A maliciou...

CVE-2026-47425 Rattler vulnerable to entry-point path traversal in noarch:python install (arbitrary file write)

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A maliciou...

CVE-2026-47425

Summary: CVE-2026-47425 affects rattler before 0.43.2, enabling a noarch:python entry-point path traversal that can write files outside the intended install prefix. The issue arises in EntryPoint::FromStr within rattler_conda_types, where only .trim() is applied to the command and a malicious noa...

CVE-2026-47425 Rattler vulnerable to entry-point path traversal in noarch:python install (arbitrary file write)

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A maliciou...

Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`

Description PIL/GdImageFile.py GdImageFile.open reads image dimensions from the GD 2.x header and stores them in self.size without calling Image.decompressionbombcheck. Because GdImageFile is not registered with Image.registeropen, it never passes through the standard Image.open code path that...

python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite

A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to wri...