ShellGhost

ShellGhost A memory-based evasion technique which makes shellcode invisible from process start to end. Motivation I wanted to share this shellcode self-injection POC to showcase some AV/EDR evasion concepts that may turn useful for Red Teaming. Just a few weeks ago I came up with a custom in-memo...

struts2_cve-2017-5638

struts2cve-2017-5638 This is a sort of Java porting of the Python exploit at: https://www.exploit-db.com/exploits/41570/. This software is written to have no external dependencies. DISCLAIMER This tool is intended for security engineers and appsec guys for security assessments. Please use this to...

VectoredOverloading

VectoredOverloading Vectored Overloading is a local PE injection technique that was first observed in the KidKadi malware. It works by manipulating the load of a legitimate DLL using Hardware Breakpoints HWBP and Vectored Exception Handling VEH to change the DLL section object on-the-fly...

Apache-Dubbo-Hessian2-CVE-2021-43297

Deserialization during Apache Dubbo Hessian2 Exception Handling CVE-2021-43297 1. Import the two projects into two separate IDEA instances 2. First run org.apache.dubbo.samples.basic.BasicProvidermain to start the server 3. Then run org.apache.dubbo.samples.basic.BasicConsumermain to start the...

instrumentation_callbacks

instrumentationcallbacks Instrumentation callbacks are quite a fun undocumented part of Windows. All the code in this repository is released under the MIT license. This repository uses google style C++ spacing. PRs are welcome if you find issues, bugs, or believe a specific feature should be adde...

moonwalk

moonwalk: DLL Base Address Finder This Rust library and CLI tool demonstrates an alternative method to find the base address of loaded DLLs without using a Process Environment Block PEB walk. This technique is particularly useful in scenarios where PEB walking might be detected or blocked. Branch...

CVE-2017-5638

CVE-2017-5638 | Struts s2-045 Description It is possible to perform a RCE attack with a malicious Content-Type value. If the Content-Type value isn't valid an exception is thrown which is then used to display an error message to a user. Affected versions Struts 2.3.5 Struts 2.3.31 Struts 2.5 Stru...

TamperingSyscalls

TamperingSyscalls TamperingSyscalls is a 2 part novel project consisting of argument spoofing and syscall retrival which both abuse EH in order to subvert EDRs. This project consists of both of these projects in order to provide an alternative solution to direct syscalls. Tampering with syscalls...

Vectored-Exception-Handling-Squared

Vectored Exception Handling Squared A Rust Proof of Concept. Read more on my blog, all original research by CrowdStrike, this is just the POC for it! Unless I am blind; there does not seem to be much out there POC's etc relating to the discovery made by CrowdStrike researchers, called Vectored...

CVE-2024-52316

🚨🚨CVE-2024-52316🚨🚨 🚨🚨CVE-2024-52316 - Apache Tomcat Authentication Bypass Vulnerability Overview CVE202452316 is an authentication bypass vulnerability identified in Apache Tomcat. This issue arises when Tomcat is configured with a custom Jakarta Authentication formerly JASPIC ServerAuthContext...

xmlrpc-bruteforcer

An XMLRPC BruteForcer for Wordpress - Inpired by 1N3@CrowdShield Note - This project is discontinued Usage python3 xmlrcpbruteforce.py http://wordpress.org/xmlrpc.php passwords.txt username python3 xmlrpcbruteforce.py http://wordpress.org/xmlrpc.php passwords.txt userlist.txt in progess Target is...

Apache Tomcat improper exception handling vulnerability

The Apache Tomcat versions from 11.0.0-M14 to 11.0.26, from 10.1.22 to 10.1.60, and from 9.0.92 to 9.0.122 have a vulnerability related to improper exception handling. This vulnerability arises when the OpenSSL LifecycleListener is configured to use FIPS mode, but FIPS activation fails. As a...

Pillow improper exception handling vulnerabilities

Pillow versions from 9.1.0 to 13.0.0 have a vulnerability related to improper exception handling. This vulnerability arises when the ImagingPaletteCacheUpdate function is used with an air-conditioned palette, and the local cache array is not initialized. As a result, the conversion path uses...

Security update for python-PyJWT (important)

openSUSE security update: security update for python-pyjwt ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22074-1 Rating: important References: bsc1283060 bsc1283061 bsc1283064 bsc1283065 bsc1283066 bsc1283067 bsc1283068 bsc1283071 bsc1283072...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu: Fixed the refcount leak in the address translation for armsmmudevice. The reference counting issue occurs in several exception handling paths of armsmmuiovatophyshard. When these error scenarios occur, the functio...

Astra Linux – vulnerability in linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Flush exception handling work when RPM level is zero Ensure that the exception event handling work is explicitly flushed during suspend when the runtime power management level is set to UFSPMLVL0. When the RPM...

Jordan Harband: Improper exception handling leads to vulnerabilities

Jordan Harband versions from 6.7.0 to 6.16.1 have security vulnerabilities. This vulnerability arises from improper string coercion of array elements when using arrayFormat with a comma. When elements cannot be converted to strings, a type error will occur, potentially allowing unverified attacke...

Parse Platform Parse Server Improper Exception Handling Vulnerability

The Parse Platform and Parse Server versions prior to 8.6.95, as well as versions from 9.0.0 to 9.10.2-alpha.3, have a vulnerability related to improper exception handling. This vulnerability arises from the lack of parsing of URL references in files when objects are passed to Cloud Code triggers...

CVE-2026-105242

Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: sparc: fixed inaccurate exception reporting in copyfromtouser for UltraSPARC. The referenced commit introduced exception handlers for user-space memory references in copyfromuser and copytouser. These handlers return from the...