TestCitrixException

Test Citrix Exception CVE-2025-6759 완화 테스트 Citrix 문서는 CVE-2025-6759에 대해 레지스트리에서 Citrix 예외 처리기를 비활성화하는 대체 완화 방법을 설명합니다. 그러나 해당 문서는 이 변경으로 인해 VDA 서비스 또는 서버 재시작이 필요한가? 라는 질문에 답하지 않습니다. 그래서 이 도구는 이를 테스트하기 위해 만들어졌습니다. 출처: CTX676735는 해당 예외 처리와 레지스트리 키가 어떻게 작동하는지에 대한 추가 정보를 제공합니다. Rapid 7의 블로그 게시물은 이 취약...

EATGuard

EATGuard Export Address Filtering EAF のような、エクスポートアドレステーブル保護の緩和策の実装です。 仕組み このプロジェクトは3つのバイナリで構成されており、コンパイルすると EATGuard\bin\ にあります。それらは以下のとおりです: 1. EATGuardApplication.exe - プロセスに EATGuardDll.dll を読み込み、その後 notepad.exe を実行する実行可能コード（シェルコード）を実行する「悪意のある」アプリケーションです。 2. EATGuardDll.dll -...

Voidgate

VOIDGATE 설명: AV/EDR 메모리 스캐너를 우회bypass하는 데 사용할 수 있는 기술입니다. 잘 알려지고 탐지되는 셸코드예: msfvenom를 개별 암호화된 어셈블리 명령어를 실시간on-the-fly 복호화하여 숨길 수 있으므로, 해당 메모리 페이지에 대해서는 메모리 스캐너가 무용지물이 됩니다. 작동 원리: 이 기술은 암호화된 어셈블리 명령어가 저장될 PAGEEXECUTEREADWRITE 메모리 영역을 생성합니다. 셸코드는 일부 패딩padding으로 감싸집니다. 프로그램은 셸코드의 엔트리포인트에 하드웨어...

VehApiResolve

VehApiResolve Dridex Loader의 32비트 API 난독화에서 영감을 받았습니다. 어떻게 동작하나요? 예외 처리기를 설정합니다. root@kitploit: AddVectoredExceptionHandler CALLFIRST, ApiResolverHandler ; 이 예외 처리기는 EXCEPTIONBREAKPOINT로 발생된 예외만 처리합니다. 우리가 이 예외를 발생시키면 CONTEXT를 캡처할 수 있습니다. 전달된 인수를 얻을 수 있습니다. RDX와 R8은 함수 및 모듈 해시를 보관합니다. 그런 다음 아래와 같...

CVE-2018-18912

🐞 CVE-2018-18912: Easy File Sharing Web Server 7.2 - 스택 기반 버퍼 오버플로우 SEH Easy File Sharing Web Server 7.2에서 SEH 기반 버퍼 오버플로우를 보여줍니다. 인증된 HTTP POST 매개변수가 예외 처리기 체인을 손상시킬 수 있음을 시연합니다. 📑 목차 이 저장소가 존재하는 이유 이 취약점이 흥미로운 이유 맥락 및 영향받는 소프트웨어 취약점 정보 크래시 유발 익스플로잇 🎓 이 저장소가 존재하는 이유 이 저장소는 메모리 손상 익스플로잇을 가르칠 때 사용...

CVE-2019-25733

NetShareWatcher 1.5.8.0 contains a structured exception handler buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying malicious input. Attackers can craft a payload with overwritten SEH and NSEH pointers through the Restrictions custom filter field to...

EUVD-2019-20169

NetShareWatcher 1.5.8.0 contains a structured exception handler buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying malicious input. Attackers can craft a payload with overwritten SEH and NSEH pointers through the Restrictions custom filter field to...

CVE-2019-25733

NetShareWatcher 1.5.8.0 contains a structured exception handler buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying malicious input. Attackers can craft a payload with overwritten SEH and NSEH pointers through the Restrictions custom filter field to...

PT-2026-46203

NetShareWatcher 1.5.8.0 contains a structured exception handler buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying malicious input. Attackers can craft a payload with overwritten SEH and NSEH pointers through the Restrictions custom filter field to...

Nsasoft NetShareWatcher 安全漏洞

Nsasoft NetShareWatcher is a security auditing tool developed by the US company Nsasoft. Version 1.5.8.0 of Nsasoft NetShareWatcher contains a security vulnerability. This vulnerability stems from a buffer overflow in the structured exception handler, which could allow local attackers to execute...

EUVD-2018-21953

Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by overwriting the structured exception handler. Attackers can craft a malicious input file with a 672-byte offset to overwrite the nSEH and SEH pointers, enabling code execution through...

CVE-2018-25432

Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by overwriting the structured exception handler. Attackers can craft a malicious input file with a 672-byte offset to overwrite the nSEH and SEH pointers, enabling code execution through...

CVE-2018-25427

Arm Whois 3.11 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by supplying oversized input to the IP address or domain field. Attackers can craft malicious input exceeding 658 bytes with shellcode to overwrite the structured exception...

CVE-2018-25432 Arm Whois 3.11 Buffer Overflow via ASLR Bypass

Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by overwriting the structured exception handler. Attackers can craft a malicious input file with a 672-byte offset to overwrite the nSEH and SEH pointers, enabling code execution through...

CVE-2018-25432

Arm Whois 3.11 is affected by a local buffer overflow that allows code execution via exception handler hijacking. An input file crafted with a 672-byte offset can overwrite nSEH and SEH pointers, enabling arbitrary code execution when the structured exception handler is triggered. CVSS data prese...

CVE-2018-25432 Arm Whois 3.11 Buffer Overflow via ASLR Bypass

Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by overwriting the structured exception handler. Attackers can craft a malicious input file with a 672-byte offset to overwrite the nSEH and SEH pointers, enabling code execution through...

CVE-2018-25427 Arm Whois 3.11 Buffer Overflow via SEH Overwrite

Arm Whois 3.11 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by supplying oversized input to the IP address or domain field. Attackers can craft malicious input exceeding 658 bytes with shellcode to overwrite the structured exception...

PT-2026-45623

Name of the Vulnerable Software and Affected Versions Arm Whois version 3.11 Description A buffer overflow allows local attackers to execute arbitrary code by overwriting the structured exception handler. By crafting a malicious input file with a 672-byte offset, an attacker can overwrite the nSE...

PT-2026-45618

Name of the Vulnerable Software and Affected Versions Arm Whois version 3.11 Description A stack-based buffer overflow occurs when the application processes oversized input in the IP address or domain fields. Remote attackers can provide input exceeding 658 bytes containing shellcode to overwrite...

CVE-2018-25360

AgataSoft Auto PingMaster 1.5 contains a stack-based buffer overflow vulnerability in the Trace Route host name field that allows local attackers to execute arbitrary code by triggering structured exception handling. Attackers can craft a malicious ping.txt file with shellcode and jump instructio...