BOF_RunPe

BOFRunPE BOF RunPE is a Beacon Object File for Cobalt Strike that executes PE files entirely in-memory within the beacon process. Unlike traditional fork&run, no child process is spawned, no console is created, and no pipe is used - all output is captured via IAT hooking and redirected to the...

IronPE

IronPE - Minimal Windows PE manual loader written in Rust. Rust PE Loader / Manual Mapping Implementation IronPE is a minimal Windows PE manual loader written in Rust for both x86 and x64 PE files. This project is a Rust reimplementation of my previous project dotNetPELoader , which implemented a...

Ladon

Ladon Large-scale Intranet Penetration Scanner Cobalt Strike Plugin Memory Loading Program Introduction Ladon is a large-scale intranet penetration scanner, domain penetration, and lateral movement tool, featuring PowerShell modules, Cobalt Strike plugins, memory loading, and fileless scanning. I...

ExecuteAssembly

Description: ExecuteAssembly is an alternative of CS execute-assembly, built with C/C++ and it can be used to Load/Inject .NET assemblies by; reusing the host spawnto process loaded CLR Modules/AppDomainManager, Stomping Loader/.NET assembly PE DOS headers, Unlinking .NET related modules, bypassi...

DexLoader

⚡Dex Loader Android This project demonstrates different methods of loading and executing DEX files in Android, with a focus on dynamic loading techniques such as DexClassLoader, PathClassLoader, and in-memory execution. 📦 Project Structure Dex Loader : Loads and executes contacts.dex, which...

java-remote-class-loader

This tool allows you to send Java bytecode in the form of class files to your clients or potential targets to load and execute using Java ClassLoader together with Reflect API. The client receives the class file from the server and return the respective execution output. Payloads must be written ...

FsquirtCPLPoC

Fsquirt.exe Windows binary attempts to load a Control Panel applet CPL called bthprops.cpl from its current working directory. When bthprops.cpl is present alongside fsquirt.exe, the binary loads it and executes a MessageBox from DLLMain. This PoC code generates a malicious bthprops.cpl file that...

CLR-Unhook

CLR Unhooking Tool Note: For this to have the effect of a clean CLR, you’d need to manually map the DLL from disk into memory. You cannot use LoadLibraryA/W, because antivirus solutions will detect the DLL load event and may hook it immediately. If you want this behavior, you can look up existing...

Elph Mobile Unverified Code Upload

The vulnerability in the Elph Mobile unified communications platform is related to code loading without proper integrity checks. Exploitation of this vulnerability could allow a remote attacker to compromise the confidentiality and integrity of protected information...

OpenSky Flight Planning Unrestricted File Execution

The vulnerability of the OpenSky flight planning and operational management system lies in its ability to load files of a dangerous type without limitation. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code...

CVE-2021-40444

CVE-2021-40444 PoC Malicious docx generator to exploit CVE-2021-40444 Microsoft Office Word Remote Code Execution Creation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 docx file You need to...

CVE-2026-122188

The DeepGraphLearning KnowledgeGraphEmbedding component is vulnerable to a path traversal flaw in the Checkpoint Loading component. Specifically, the override_config function in codes/run.py fails to properly sanitize the data_path argument. This flaw allows an attacker to initiate a remote attac...

EUVD-2026-117266

A flaw has been found in DeepGraphLearning KnowledgeGraphEmbedding up to 2e440e0f9c687314d5ff67ead68ce985dc446e3a. Impacted is the function overrideconfig of the file codes/run.py of the component Checkpoint Loading. This manipulation of the argument datapath causes path traversal. The attack can...

NocoBase - SQL Injection

NocoBase versions prior to 2.0.39 contain a SQL injection vulnerability in the @nocobase/database package. The queryParentSQL function in eager-loading-tree.ts constructs a recursive CTE query by directly concatenating user-controlled primary key values into the SQL WHERE IN clause without...

OX Appsuite - Cross-Site Scripting

OX App Suite through 7.10.4 allows XSS via the app loading mechanism the PATHINFO to the /appsuite URI. id: CVE-2020-24701 info: name: OX Appsuite - Cross-Site Scripting author: DhiyaneshDk severity: medium description: | OX App Suite through 7.10.4 allows XSS via the app loading mechanism the...

InflativeLoading

InflativeLoading Article: https://winslow1984.com/books/malware/page/reflectiveloading-and-inflativeloading Major Update History In this section, major updates are provided. Major updates do include added supports or features. 4/11/2024 Added PE Signature Obfuscation Only a few bytes in the PE...

DarkLoadLibrary

DarkLoadLibrary LoadLibrary for offensive operations. How does it work? https://www.mdsec.co.uk/2021/06/bypassing-image-load-kernel-callbacks/ Usage DARKMODULE DarkModule = DarkLoadLibrary LOADLOCALFILE, // control flags L"TestDLL.dll", // local dll path, if loading from disk NULL, // dll buffer ...

upx

ooooo ooo ooooooooo. ooooooo ooooo 888' 8' 888 Y88. 8888 d8' 888 8 888 .d88' Y888..8P 888 8 888ooo88P' 8888' 888 8 888 .8PY888. 88. .8' 888 d8' 888b YbodP' o888o o888o o88888o The Ultimate Packer for eXecutables Copyright c 1996-2026 Markus Oberhumer, Laszlo Molnar & John Reiser...

PT-2026-137321

A flaw has been found in DeepGraphLearning KnowledgeGraphEmbedding up to 2e440e0f9c687314d5ff67ead68ce985dc446e3a. Impacted is the function override config of the file codes/run.py of the component Checkpoint Loading. This manipulation of the argument data path causes path traversal. The attack c...

amber

Inroduction Amber is a position-independentreflective PE loader that enables in-memory execution of native PE filesEXE, DLL, SYS.... It enables stealthy in-memory payload deployment that can be used to bypass anti-virus, firewall, IDS, IPS products, and application white-listing mitigations...