23 matches found
dyen
dyen dyen loads a Mach-O dylib in memory using stock macOS Python and calls an exported entry point without dlopen on that dylib. The aim is that the image is never a standalone file on the target and is never registered with dyld. by cenobyte [email protected] 2026...
BlackHole
BlackHole C RAT Remote Adminitration Tool Educational purposes only Technologies protobuf-net : message serialization/deserialization in slavemaster protocol NetMQ : network library used for the slavemaster system clientserver Lz4.Net : compression library ILMerge : packaging assemblies into a...
PythonMemoryModule
PythonMemoryModule Implementación en Python puro de la técnica MemoryModule para cargar una DLL o un ejecutable no administrado completamente desde la memoria Imagen de "Python memory module" generada por IA - hotpot.ai ¿Qué es? PythonMemoryModule es un port a ctypes de Python de la técnica...
HeaderLessPE
HeaderLessPE Introducción 中文 HeaderLessPE es una técnica de carga de PE en memoria utilizada por el troyano Icedid. Basándonos en esta tecnología, proponemos una nueva forma de ataque sin archivos utilizando HVNC. Esta mejora permite inyectar HeaderLessPE para ejecutar herramientas gráficas de...
Nim-RunPE
Nim-RunPE A Nim implementation of reflective PE-Loading from memory. The base for this code was taken from RunPE-In-Memory - which I ported to Nim. You'll need to install the following dependencies: nimble install ptrmath winim I did test this with Nim Version 1.6.2 only, so use that version for...
Ladon
Ladon Large-scale Intranet Penetration Scanner Cobalt Strike Plugin Memory Loading Program Introduction Ladon is a large-scale intranet penetration scanner, domain penetration, and lateral movement tool, featuring PowerShell modules, Cobalt Strike plugins, memory loading, and fileless scanning. I...
FilelessPELoader
FilelessPELoader Carica un PE remoto crittografato AES in memoria, lo decritta e lo esegue Utilizzo : Riferimenti : https://github.com/aplyc1a/PEMemoryLoader?fbclid=IwAR2-VAQo8pJU-tdbSENjhDBdDGi5tyzrnW1S3D9BPAYR6C6-RK4hsEDjDGk Requisiti 1. hashlib 2. pycryptodome 3. pycryptodomex...
ELFLoader
ELFLoader Este é um carregador/executor de objetos ELF em memória. O objetivo é criar um único carregador de ELF que possa ser usado para executar capacidades subsequentes em todos os sistemas operacionais x8664 e x86 nix. Como funciona A maneira como este carregador funciona é que ele contém tod...
GHSA-V9PG-7XVM-68HF python-multipart: Negative Content-Length in parse_form buffers the entire body in memory
Summary parseform did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. Details...
CVE-2026-33332
NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.addmediafile and app.addmediafiles media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without...
SUSE CVE-2025-54470
This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled. When this option is enabled, NeuVector sends anonymous telemetry data to the telemetry server. In affected versions, NeuVector does not enforce TLS certificate verification when...
Hackers Found Using CrossC2 to Expand Cobalt Strike Beacon's Reach to Linux and macOS
Japan's CERT coordination center JPCERT/CC on Thursday revealed it observed incidents that involved the use of a command-and-control C2 framework called CrossC2, which is designed to extend the functionality of Cobalt Strike to other platforms like Linux and Apple macOS for cross-platform system...
CVE-2025-51726
CyberGhostVPNSetup.exe Windows installer is signed using the weak cryptographic hash algorithm SHA-1, which is vulnerable to collision attacks. This allows a malicious actor to craft a fake installer with a forged SHA-1 certificate that may still be accepted by Windows signature verification...
Security update for the Linux Kernel (Live Patch 14 for SLE 15 SP5)
This update for the Linux Kernel 5.14.21-1505005565 fixes several issues. The following security issues were fixed: CVE-2024-53156: wifi: ath9k: add range check for connrspepid in htcconnectservice bsc1234847. CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage bsc1229504...
KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
...
Whispers of Atlantida: Safeguarding Your Digital Treasure
Recently, Rapid7 observed a new stealer named Atlantida. The stealer tricks users to download a malicious file from a compromised website, and uses several evasion techniques such as reflective loading and injection before the stealer is loaded. Atlantida steals a wide range of login information ...
CVE-2023-41042 Discourse DoS via remote theme assets
Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, importing a remote theme loads their assets into memory without enforcing limits for file size or number of files. The issue is patched in...
CVE-2023-29747
Story Saver for Instragram - Video Downloader 1.0.6 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The attacker can use the method to modify the data in any SharedPreference file, these data will be loaded into the memory when the...
Nim-RunPE - A Nim Implementation Of Reflective PE-Loading From Memory
A Nim implementation of reflective PE-Loading from memory. The base for this code was taken from RunPE-In-Memory - which I ported to Nim. You'll need to install the following dependencies: nimble install ptrmath winim I did test this with Nim Version 1.6.2 only, so use that version for testing or...
