CLR-Unhook

CLR 언후킹 도구 참고: 깨끗한 CLR 효과를 보려면 디스크에서 DLL을 수동으로 메모리에 매핑해야 합니다. LoadLibraryA/W를 사용할 수 없습니다. 안티바이러스 솔루션이 DLL 로드 이벤트를 감지하고 즉시 후킹할 수 있기 때문입니다. 이 동작을 원한다면 GitHub에 있는 기존 수동 매퍼를 찾아 코드베이스에 통합할 수 있습니다. AV 업체들이 일반적으로 이를 좋아하지 않기 때문에 여기에는 포함하지 않았습니다. .NET 공용 언어 런타임에서 원래 nLoadImage 함수 구현을 복원하여 EDR/AV 후크를 우회하는...

CustomLoadImage

CustomLoadImage CustomLoadImage 는 .NET 어셈블리의 은밀한 리플렉티브 로딩을 가능하게 합니다. 이는 AssemblyNative::LoadFromBuffer 를 직접 호출하여 RuntimeAssembly.nLoadImage 에 설치된 후크가 실행되지 않도록 합니다. 이 프로젝트가 도움이 되셨다면 스타를 눌러주세요...

HallWatch

HallWatch Copyright C 2026 Adam Zypherion — GPL-3.0 のもとでライセンスされています。 間接システムコールは、一度見れば簡単です。ローダーは ntdll をウォークし、Nt プロローグから SSN を読み取り、さらに 2 バイト先の 0F 05 を見つけ、自身で r10/rax/rdx/r8/r9 を設定し、その 2 バイトに jmp します。Syscall は ntdll 内部から発生します。kernel32 のエクスポートに対するフックは触れられません。ntdll のエクスポートに対するフックも触れられません。SYSCALL の瞬間の...

HellHall

HellsHall - 클린 시스템 콜을 가져오는 또 다른 방법 HellsHall은 HellsGate와 간접 시스템 콜indirect syscalls의 결합입니다. 작동 방식 먼저 HellsHall은 시스템 콜 주소 가 후킹되었는지 확인하고 다음 바이트들의 존재를 검사하여 시스템 콜 번호를 검색합니다: 0x4C, 0x8B, 0xD1, 0xB8 이는 mov r10,rcx && mov eax,SSn을 나타냅니다. 모든 시스템 콜은 이렇게 시작해야 합니다. 이 시점에서 HellsGate는 Syscall SSn시스템 콜 번호을 가져와서...

RefleXXion

소개 RefleXXion은 AV/EPP/EDR 등에서 사용하는 사용자 모드 후크를 우회하는 데 도움을 주는 유틸리티입니다. 사용자 모드 후크를 우회하기 위해 먼저 LdrpThunkSignature 배열에서 NtOpenFile, NtCreateSection, NtOpenSection 및 NtMapViewOfSection의 시스템 콜 번호를 수집합니다. 그런 다음 사용자가 선택할 수 있는 두 가지 기술이 있습니다. 기술-1은 C:\Windows\System32\ntdll.dll에서 NTDLL을 파일로 읽어옵니다. 파싱 후 메모리에...

DEBIAN-CVE-2026-93710

Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compilehooks. A hook that dies fires core.app.hookexception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does...

CVE-2026-93710

Dancer2 versions 2.0.0 through 2.1.x for Perl are vulnerable to an improper cleanup issue during exception handling in compile_hooks. When a hook dies and fires core.app.hook_exception, the system initiates a cleanup process. If the exception handler halts the response without stopping this clean...

PT-2026-96324

Name of the Vulnerable Software and Affected Versions Dancer2 versions 2.0.0 through 2.1.x Description An issue exists where a route is dispatched even if a dying hook refused it, occurring when the exception handler halts the response in compile hooks. When a hook dies, it triggers core.app.hook...

RestrictedPython guard hooks can be shadowed via positional-only arguments

ImpactRestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes getattrobj, name, item access becomes getitemobj, key, writes go through write, and print goes through print. The embedding application supplies these hooks to enforce its policy.Argument-name...

Exploit for Improper Input Validation in Apache Traffic_Server

CVE-2026-33267 — Apache Traffic Server untrusted @ header →...

CVE-2026-66010

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into...

EUVD-2026-37147

OpenClaw: Skill-command dispatch could skip before-tool-call hooks...

Protection Mechanism Failure

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Protection Mechanism Failure in the skill-command dispatch process. An attacker can bypass hook-based auditing or policy enforcement by routing a skill command through a dispatch path tha...

CVE-2026-53845

OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch path skip before-tool-call hook coverage. Attackers can exploit this by sending skill commands through the vulnerable dispatch path to bypass hook-based auditing and policy...

CVE-2026-53845 OpenClaw < 2026.5.6 - Skill-Command Dispatch Hook Bypass via Before-Tool-Call Hook Skipping

OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch path skip before-tool-call hook coverage. Attackers can exploit this by sending skill commands through the vulnerable dispatch path to bypass hook-based auditing and policy...

CVE-2026-53845 OpenClaw < 2026.5.6 - Skill-Command Dispatch Hook Bypass via Before-Tool-Call Hook Skipping

OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch path skip before-tool-call hook coverage. Attackers can exploit this by sending skill commands through the vulnerable dispatch path to bypass hook-based auditing and policy...

CVE-2026-53845 OpenClaw < 2026.5.6 - Skill-Command Dispatch Hook Bypass via Before-Tool-Call Hook Skipping

OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch path skip before-tool-call hook coverage. Attackers can exploit this by sending skill commands through the vulnerable dispatch path to bypass hook-based auditing and policy...

CVE-2026-53845

OpenClaw prior to version 2026.5.6 has a hook bypass in the skill-command dispatch path, where commands routed through the affected path skip the before-tool-call hook coverage, potentially bypassing auditing and policy enforcement. This is described in the CVE entry as a dispatch hook bypass vul...

PT-2026-49762

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.6 Description A hook bypass issue exists where skill commands routed through a specific dispatch path skip the runBeforeToolCallHook coverage. This allows attackers to send skill commands through the affected...

CVE-2026-53845: Protection Mechanism Failure

OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch path skip before-tool-call hook coverage. Attackers can exploit this by sending skill commands through the vulnerable dispatch path to bypass hook-based auditing and policy...