aDLL

aDLL - مغامرة مكتبة الارتباط الديناميكي Adventure of Dynamic Link Library aDLL هي أداة تحليل ثنائي تركز على الاكتشاف التلقائي لثغرات اختطاف DLL. تقوم الأداة بتحليل صورة الملف القابل للتنفيذ المحملة في الذاكرة للبحث عن ملفات DLL المحملة وقت التحميل، وتستخدم مكتبة Microsoft Detours لاعتراض...

pe-bear

PE-bear PE-bear is a multiplatform reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files...

obex

Obex - Blocage de DLL Obex est un outil/technique de preuve de concept PoC qui peut être utilisé pour empêcher des modules indésirables par exemple, des bibliothèques EDR ou de surveillance d'être chargés dans un processus nouvellement démarré pendant l'initialisation du processus ou à l'exécutio...

doublepulsar-usermode-injector

Auteur : Matt Hillman [email protected] - @sp1nl0ck Société : Countercept @countercept Site web : https://countercept.com Un utilitaire qui utilise le shellcode en mode utilisateur de la charge utile DOUBLEPULSAR pour charger de manière réflexive une DLL arbitraire dans un autre processus,...

CdpSvcLPE

CdpSvcLPE Élévation de privilèges locale Windows via le service CdpSvc détournement de DLL dans un chemin système accessible en écriture Brève description : Le service Connected Devices Platform ou CDPSvc est un service qui s'exécute en tant que NT AUTHORITY\LOCAL SERVICE et tente de charger la D...

CVE-2026-38972

Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibraryL"MSFTEDIT.DLL" with a bare DLL name, which allows a local attacker to place a malicious MSFTEDIT.DLL in the application directory or...

CVE-2026-38972

Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibraryL"MSFTEDIT.DLL" with a bare DLL name, which allows a local attacker to place a malicious MSFTEDIT.DLL in the application directory or...

CVE-2026-38972

Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibraryL"MSFTEDIT.DLL" with a bare DLL name, which allows a local attacker to place a malicious MSFTEDIT.DLL in the application directory or...

EUVD-2019-19004

Malware in sbrugna...

EUVD-2015-1888

Malware in sbrugna...

EUVD-2018-12467

Malware in sbrugna...

EUVD-2016-4967

Malware in sbrugna...

LightsOut - Generate An Obfuscated DLL That Will Disable AMSI And ETW

LightsOut will generate an obfuscated DLL that will disable AMSI & ETW while trying to evade AV. This is done by randomizing all WinAPI functions used, xor encoding strings, and utilizing basic sandbox checks. Mingw-w64 is used to compile the obfuscated C code into a DLL that can be loaded into a...

The vulnerability of the LoadLibrary function in the cross-platform framework for developing Qt software allows a perpetrator to gain access to protected information.

The vulnerability of the LoadLibrary function in the cross-platform framework for developing Qt software relates to the possibility of bypassing the directory. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to protected information...

TFTP Fetch, Windows x64 LoadLibrary Path

Fetch and execute an x64 payload from a TFTP server. Load an arbitrary x64 library path Module Options msf use payload/cmd/windows/tftp/x64/loadlibrary msf payloadloadlibrary show actions ...actions... msf payloadloadlibrary set ACTION msf payloadloadlibrary show options ...show and set options...

HTTP Fetch, Windows x64 LoadLibrary Path

Fetch and execute an x64 payload from an HTTP server. Load an arbitrary x64 library path Module Options msf use payload/cmd/windows/http/x64/loadlibrary msf payloadloadlibrary show actions ...actions... msf payloadloadlibrary set ACTION msf payloadloadlibrary show options ...show and set options...

GO-2022-0220 DLL injection on Windows in runtime and syscall

Go on Windows misused certain LoadLibrary functionality, leading to DLL injection...

Duplicate Advisory: Kerberos for NodeJS allows DLL Injection

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m2mx-rfpw-jghv. This link is maintained to preserve external references. Original Description The kerberos package before 1.0.0 for Node.js allows arbitrary code execution and privilege escalation via injection ...

GHSA-F478-XWV9-P93Q Duplicate Advisory: Kerberos for NodeJS allows DLL Injection

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m2mx-rfpw-jghv. This link is maintained to preserve external references. Original Description The kerberos package before 1.0.0 for Node.js allows arbitrary code execution and privilege escalation via injection ...

Powershell Exec, Windows x64 LoadLibrary Path

Execute an x64 payload from a command via PowerShell. Load an arbitrary x64 library path Module Options msf use payload/cmd/windows/powershell/x64/loadlibrary msf payloadloadlibrary show actions ...actions... msf payloadloadlibrary set ACTION msf payloadloadlibrary show options ...show and set...