pe-bear

PE-bear PE-bear is a multiplatform reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files. Signatures for PE-bear: SIG.txt updated: Oct 17, 2022 - contains signatures fromPEid's UserDB -...

doublepulsar-usermode-injector

DOUBLEPULSAR 사용자 모드 인젝터 저자: Matt Hillman [email protected] - @sp1nl0ck 회사: Countercept @countercept 웹사이트: https://countercept.com DOUBLEPULSAR 페이로드의 사용자 모드 셸코드를 사용하여 임의의 DLL을 다른 프로세스에 반사적으로 로드하는 유틸리티로, 탐지 기술 테스트 또는 기타 보안 연구에 사용됩니다. 배경 Shadow Brokers가 공개한 DOUBLEPULSAR 페이로드는 처음에 커널 모드에서 실행되며...

aDLL

aDLL - 동적 링크 라이브러리의 모험 aDLL은 DLL 하이재킹 취약점을 자동으로 발견하는 데 중점을 둔 바이너리 분석 도구입니다. 이 도구는 메모리에 로드된 바이너리 이미지를 분석하여 로드 시점에 로드된 DLL을 검색하고, Microsoft Detours 라이브러리를 사용하여 LoadLibrary/LoadLibraryEx 함수 호출을 가로채서 런타임에 로드된 DLL을 분석합니다. 목적은 실행 파일이 DLL을 검색하는 폴더에서 찾을 수 없는 DLL 목록을 얻는 것입니다. 시작하기 aDLL을 사용하려면 Binaries 폴더에...

obex

Obex - DLL 차단 Obex 는 원치 않는 모듈예: EDR 또는 모니터링 라이브러리이 프로세스 초기화 중 또는 런타임에 새로 시작된 프로세스에 로드되는 것을 방지하는 데 사용할 수 있는 PoC 도구/기법입니다. 기능 디버그 제어 하에 인수를 포함한 모든 프로세스를 생성합니다. 이름으로 구성 가능한 DLL 목록을 차단합니다. 시작 DLL과 동적으로 로드되는 DLLLoadLibrary 모두에서 작동합니다. 외부 종속성 없이 순수 C 언어로 작성되었습니다. 사용법 obex.exe "" dll1.dll,dll2.dll,... D...

CdpSvcLPE

CdpSvcLPE CdpSvc 서비스를 통한 Windows 로컬 권한 상승 쓰기 가능한 SYSTEM 경로 DLL 하이재킹 간단한 설명: Connected Devices Platform Service또는 CDPSvc는 NT AUTHORITY\LOCAL SERVICE 권한으로 실행되는 서비스로, 시작 시 절대 경로를 지정하지 않은 채 LoadLibrary 호출로 누락된 cdpsgshims.dll DLL을 로드하려고 시도합니다. 따라서 DLL 검색 순서Dll Search Order 흐름의 폴더에서 DLL을 하이재킹할 수 있으며,...

CVE-2026-38972

Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibraryL"MSFTEDIT.DLL" with a bare DLL name, which allows a local attacker to place a malicious MSFTEDIT.DLL in the application directory or...

CVE-2026-38972

Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibraryL"MSFTEDIT.DLL" with a bare DLL name, which allows a local attacker to place a malicious MSFTEDIT.DLL in the application directory or...

CVE-2026-38972

Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibraryL"MSFTEDIT.DLL" with a bare DLL name, which allows a local attacker to place a malicious MSFTEDIT.DLL in the application directory or...

CVE-2026-38972

Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibraryL"MSFTEDIT.DLL" with a bare DLL name, which allows a local attacker to place a malicious MSFTEDIT.DLL in the application directory or...

EUVD-2019-19004

Malware in sbrugna...

EUVD-2016-4967

Malware in sbrugna...

EUVD-2018-12467

Malware in sbrugna...

EUVD-2015-1888

Malware in sbrugna...

LightsOut - Generate An Obfuscated DLL That Will Disable AMSI And ETW

LightsOut will generate an obfuscated DLL that will disable AMSI & ETW while trying to evade AV. This is done by randomizing all WinAPI functions used, xor encoding strings, and utilizing basic sandbox checks. Mingw-w64 is used to compile the obfuscated C code into a DLL that can be loaded into a...

The vulnerability of the LoadLibrary function in the cross-platform framework for developing Qt software allows a perpetrator to gain access to protected information.

The vulnerability of the LoadLibrary function in the cross-platform framework for developing Qt software relates to the possibility of bypassing the directory. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to protected information...

TFTP Fetch, Windows x64 LoadLibrary Path

Fetch and execute an x64 payload from a TFTP server. Load an arbitrary x64 library path Module Options msf use payload/cmd/windows/tftp/x64/loadlibrary msf payloadloadlibrary show actions ...actions... msf payloadloadlibrary set ACTION msf payloadloadlibrary show options ...show and set options...

HTTP Fetch, Windows x64 LoadLibrary Path

Fetch and execute an x64 payload from an HTTP server. Load an arbitrary x64 library path Module Options msf use payload/cmd/windows/http/x64/loadlibrary msf payloadloadlibrary show actions ...actions... msf payloadloadlibrary set ACTION msf payloadloadlibrary show options ...show and set options...

GO-2022-0220 DLL injection on Windows in runtime and syscall

Go on Windows misused certain LoadLibrary functionality, leading to DLL injection...

Duplicate Advisory: Kerberos for NodeJS allows DLL Injection

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m2mx-rfpw-jghv. This link is maintained to preserve external references. Original Description The kerberos package before 1.0.0 for Node.js allows arbitrary code execution and privilege escalation via injection ...

GHSA-F478-XWV9-P93Q Duplicate Advisory: Kerberos for NodeJS allows DLL Injection

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m2mx-rfpw-jghv. This link is maintained to preserve external references. Original Description The kerberos package before 1.0.0 for Node.js allows arbitrary code execution and privilege escalation via injection ...