HeaderLessPE

HeaderLessPE Introduction 中文 HeaderLessPE is a memory PE loading technique used by the Icedid Trojan. Based on this technology, we propose a new way of file-less attack using HVNC . This enhancement allows to inject HeaderLessPE into execute graphical hacking tools without limitations. Compared t...

BlackHole

BlackHole C RAT Remote Adminitration Tool Educational purposes only Technologies protobuf-net : message serialization/deserialization in slavemaster protocol NetMQ : network library used for the slavemaster system clientserver Lz4.Net : compression library ILMerge : packaging assemblies into a...

PythonMemoryModule

PythonMemoryModule pure-python implementation of MemoryModule technique to load a dll or unmanaged exe entirely from memory "Python memory module" AI generated pic - hotpot.ai What is it PythonMemoryModule is a Python ctypes porting of the MemoryModule technique originally published by Joachim...

Nim-RunPE

Nim-RunPE A Nim implementation of reflective PE-Loading from memory. The base for this code was taken from RunPE-In-Memory - which I ported to Nim. You'll need to install the following dependencies: nimble install ptrmath winim I did test this with Nim Version 1.6.2 only, so use that version for...

Ladon

Ladon Large-scale Intranet Penetration Scanner Cobalt Strike Plugin Memory Loading Program Introduction Ladon is a large-scale intranet penetration scanner, domain penetration, and lateral movement tool, featuring PowerShell modules, Cobalt Strike plugins, memory loading, and fileless scanning. I...

ReflectiveDLLInjection

개요 Reflective DLL 인젝션은 반사적 프로그래밍reflective programming 개념을 활용하여 호스트 프로세스의 메모리에서 라이브러리 로딩을 수행하는 라이브러리 인젝션 기법입니다. 즉, 라이브러리가 최소한의 PEPortable Executable 파일 로더를 구현하여 스스로를 로딩하는 역할을 담당합니다. 이를 통해 호스트 시스템 및 프로세스와의 최소한의 상호작용만으로 로딩 방식과 호스트와의 상호작용 방식을 제어할 수 있습니다. 이 인젝션은 해당 아키텍처가 지원되는 Windows NT4부터 Windows 8까...

MemoryModulePP

MemoryModulePP memorymodule:https://github.com/fancycode/MemoryModule 메모리에서 DLL을 로드하는 라이브러리 memorymodule에서 수정. 예외 지원...

FilelessPELoader

FilelessPELoader Загрузка удалённого AES-зашифрованного PE в память, его расшифровка и запуск Использование : Ссылки : https://github.com/aplyc1a/PEMemoryLoader?fbclid=IwAR2-VAQo8pJU-tdbSENjhDBdDGi5tyzrnW1S3D9BPAYR6C6-RK4hsEDjDGk Требования 1. hashlib 2. pycryptodome 3. pycryptodomex...

ELFLoader

ELFLoader Это загрузчик/исполнитель ELF-объектов в памяти. Цель — создать единый загрузчик ELF, который можно использовать для запуска последующих модулей во всех nix-операционных системах на архитектурах x8664 и x86. Как это работает Этот загрузчик работает следующим образом: в нём содержится ве...

dyen

dyen dyen загружает Mach-O dylib в память с помощью штатного Python из macOS и вызывает экспортируемую точку входа без dlopen для этого dylib. Цель — чтобы образ никогда не существовал отдельным файлом на целевой системе и никогда не регистрировался в dyld. автор: cenobyte [email protected]...

GHSA-V9PG-7XVM-68HF python-multipart: Negative Content-Length in parse_form buffers the entire body in memory

Summary parseform did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. Details...

CVE-2026-33332

NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without...

SUSE CVE-2025-54470

This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled. When this option is enabled, NeuVector sends anonymous telemetry data to the telemetry server. In affected versions, NeuVector does not enforce TLS certificate verification when...

Hackers Found Using CrossC2 to Expand Cobalt Strike Beacon's Reach to Linux and macOS

Japan's CERT coordination center JPCERT/CC on Thursday revealed it observed incidents that involved the use of a command-and-control C2 framework called CrossC2, which is designed to extend the functionality of Cobalt Strike to other platforms like Linux and Apple macOS for cross-platform system...

CVE-2025-51726

CyberGhostVPNSetup.exe Windows installer is signed using the weak cryptographic hash algorithm SHA-1, which is vulnerable to collision attacks. This allows a malicious actor to craft a fake installer with a forged SHA-1 certificate that may still be accepted by Windows signature verification...

Security update for the Linux Kernel (Live Patch 14 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505005565 fixes several issues. The following security issues were fixed: CVE-2024-53156: wifi: ath9k: add range check for connrspepid in htcconnectservice bsc1234847. CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage bsc1229504...

KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory

...

Whispers of Atlantida: Safeguarding Your Digital Treasure

Recently, Rapid7 observed a new stealer named Atlantida. The stealer tricks users to download a malicious file from a compromised website, and uses several evasion techniques such as reflective loading and injection before the stealer is loaded. Atlantida steals a wide range of login information ...

CVE-2023-41042 Discourse DoS via remote theme assets

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, importing a remote theme loads their assets into memory without enforcing limits for file size or number of files. The issue is patched in...

CVE-2023-29747

Story Saver for Instragram - Video Downloader 1.0.6 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The attacker can use the method to modify the data in any SharedPreference file, these data will be loaded into the memory when the...