nosferatu

nosferatu Windows NTLM/Kerberos Authentication Backdoor How it Works First, the DLL is injected into the lsass.exe process, and will begin hooking authentication WinAPI calls. The targeted functions are: NTLM: NtlmShared!MsvpPasswordValidate Kerberos: cryptdll!CDLocateCSystem Kerberos:...

Cortex-XDR-Config-Extractor

Cortex XDR Config Extractor ⚠️ For more information, please visit https://laokoon-security.com/cortex-xdr-config-exctractor/ currently in German only This tool is meant to be used during Red Team Assessments and to audit the XDR Settings. With this tool its possible to parse the Database Lock File...

paniclock

PanicLock is a macOS menu bar utility that instantly disables Touch ID and locks the screen with a single click or closing your laptop lid. PanicLock fills a gap macOS leaves open: there is no built-in way to instantly disable Touch ID when it matters. Biometrics are convenient day-to-day, and...

kernel: s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects

A flaw was found in the Linux kernel's s390/vfio-ap component. Two functions, vfioapmdevprobe and vfioapmdevforqueue, access a list of apmatrixmdev objects without holding the required mutex. This concurrency issue could allow an attacker to cause kernel memory corruption or a use-after-free...

osv.dev

Documentation Comprehensive documentation is available here. API documentation is available here. Data Dump We have data dumps available from a GCS bucket at gs://osv-vulnerabilities. For more information check out our documentation. Viewing the web UI An instance of OSV's web UI is deployed at...

PFQ

PFQ v6.2 Introduction PFQ is a functional framework designed for the Linux operating system built for efficient packets capture/transmission 10G, 40G and beyond, in-kernel functional processing, kernel-bypass and packets steering across groups of sockets/end-points. It is highly optimized for...

CVE-2022-27254

CVE-2022-27254 PoC for vulnerability in Honda's Remote Keyless SystemCVE-2022-27254 Disclaimer: For educational purposes only. Kindly note that the discoverers for this vulnerability are Ayyappan Rajesh, a student at UMass Dartmouth and HackingIntoYourHeart. Others mentioned in this repository ar...

Lock-Picking-Robot

🔑 Unlocked 🔑 Introduction Background An open source Lock picking robot. Basically, there are many skeleton keys in use the most common example is the TSA 007, which is bad. Having one key which can open MANY different locks, especially without the lock owners people knowing it exists or can be...

claude_opus_cve_2023_0266

Demonstration that Claude 3 Opus does not understand CVE-2023-0266 and does not find it Demo 1. Even if told where the bug is Opus does not find it, and hallucinates the presence of lock acquisitions Demo 2. "Prompt engineering" aka telling the LLM exactly how to find the bug also doesn't work De...

BadParcel

BadParcel See Bundle Fengshui for a deep dive on this bug class. This repository contains PoC for CVE-2023-20963, which is mismatch in the Android WorkSource parcel/unparcel logic. The vulnerability is patched on Android's Security Bulletin of March 2023. The exploit should work on devices on AOS...

obike

oBike Protocol Description BLE/HTTP This document provides an analysis of the oBike communication protocols as of January 2018. Results have been presented at the insomni'hack security conference 2019: slides recording as well as at the AREA41 security conference 2018: slides recording General...

kernel: NFSD: Prevent client use-after-free during blocked-lock reaping

A flaw was found in the Linux kernel's Network File System Daemon NFSD. A use-after-free vulnerability can occur during the blocked-lock reaping process. This happens when a client's lock owner, without a proper reference to keep the client alive, leads to the client being prematurely freed. This...

CVE-2022-30206

CVE-2022-30206 This is the PoC for CVE-2022-30206. Introduction Perform the following operations to arbitrary file deletion： 1. Run the addprinter.exe to create a printer and set the SpoolDirectory in C:\Users\Public\tmp\1. 2. Run the FileLock.exe TargetFile to redirect .SHD file to TargetFile an...

enumhandles_BOF

enumhandlesBOF This BOF can be used to identify processes that hold handles to a given file. This can be useful to identify which process is locking a file on disk. Usage Limitations I have found that x86 beacons will crash sometimes when attempting to enumerate handles associated with an x64...

Change-Lockscreen

Change-Lockscreen Change-Lockscreen is a tool to trigger network authentications as SYSTEM by changing the Windows lock screen image from the command line to perform privilege escalation attacks such as the one described in the post linked below:...

Tourmaline

Tourmaline I recently stumbled upon a piece of cleverly designed malware that calls itself "Tourmaline". This README is very kindly written by Claude as I was super busy with exams at the time of this repository's inception. Exploiting and decrypting this malware took a huge chunk of my time from...

CVE-2026-126561

Semantic MediaWiki versions 2.5.0 before 7.4.1 are vulnerable to a missing authorization vulnerability. An editor without specific permissions can lock pages by adding the [[Is edit protected::true]] annotation or setting it via #set in widely transcluded templates. This allows an attacker to tri...

EUVD-2026-123076

Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the edit-protection right to lock pages by adding an Is edit protected annotation. Attackers can add Is edit protected::true to pages or set it in widely transcluded templates, so the...

LdrLockLiberator

LdrLockLiberator For when DLLMain is the only way LdrLockLiberator is a collection of techniques for escaping or otherwise forgoing Loader Lock while executing your code from DllMain or anywhere else the lock may be present. It was released in conjunction with the "Perfect DLL Hijacking" article...

CVE-2026-126561: SemanticMediaWiki: Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the…

Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the edit-protection right to lock pages by adding an Is edit protected annotation. Attackers can add Is edit protected::true to pages or set it in widely transcluded templates, so the...