2192 matches found
memguard
MemGuard Software enclave for storage of sensitive information in memory. This package attempts to reduce the likelihood of sensitive data being exposed when in memory. It aims to support all major operating systems and is written in pure Go. Features Sensitive data is encrypted and authenticated...
pe-sieve
Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...
NovaHypervisor
NovaHypervisor Description NovaHypervisor is a defensive x64 Intel host based hypervisor. The goal of this project is to protect against kernel based attacks either via Bring Your Own Vulnerable Driver BYOVD or other means by safeguarding defense products AntiVirus / Endpoint Protection and kerne...
ShellcodeFluctuation
Shellcode Fluctuation PoC 셸코드의 내용을 주기적으로 암호화하고 복호화하여 RW또는 NoAccess와 RX 메모리 보호 상태 사이를 오가도록 만드는 또 다른 인메모리 회피 기법의 PoC 구현체입니다. 셸코드가 RW 또는 NoAccess 메모리 페이지에 상주하면 Moneta나 pe-sieve 같은 스캐너가 이를 추적하거나 덤프하여 분석할 수 없게 됩니다. Intro ThreadStackSpoofer를 릴리스한 후 README의 다음 항목에 대한 질문을 몇 가지 받았습니다. 슬립 전에 Beacon의 메모리 페이...
ifuncd-up
Hacker News에 대한 답변으로... 주황색 웹사이트hn의 장난꾼들이 나를 괴롭히고 있는 것 같군요. 아래에 몇 가지 엄선된 답변을 준비했지만, 먼저 도전장을 내겠습니다: ifunc 없이 이 공격 을 시연할 수 있는 첫 번째 사람에게 제 돈 500달러 를 보내겠습니다. 진심으로 흥미롭고, 깨달음을 얻기 위해 기꺼이 지불할 의향이 있습니다. 이 저장소를 포크하고 작동하는 PoC와 함께 PR을 제출하세요. 승리하면 개인적으로 우편 주소를 요청하겠습니다. 이제 답변입니다: 이건 잘못된 나무를 짖는 격이다. 이보게, 나는 잘못된...
Agent-Tesla-APC-Injection-Token-Manipulation-Registry-Persistence-Analysis
1. 네이티브 API 및 APC 인젝션 x64dbg 메모리 덤프는 Agent Tesla가 하위 레벨 작업을 위해 네이티브 APINT API 호출을 사용하며, APC비동기 프로시저 호출 인젝션 을 포함함을 보여줍니다. 관찰된 주요 함수: NtQueueApcThread – APC를 통해 대상 스레드에 코드를 주입합니다. NtReadVirtualMemory – 다른 프로세스의 메모리를 읽습니다. NtQuerySystemInformation – 시스템 정보를 수집합니다. NtCreateThreadEx 있을 가능성 높음 – 실행을 위한...
cve-writeups-and-pocs
CVE-2026-80724 PoC 및 분석 문서 CVE-2026-80724 — Linux 커널 ptp: vmclock: 읽기 전용 매핑이 쓰기 가능해지는 문제 방지 전체 PoC개념 증명 + 기술 분석 문서 Abdifatah Suruursuruur의 보안 연구 — 독자적으로 발견한 취약점에 대한 CVE 분석 문서 및 PoC 모음. CVE ID : CVE-2026-80724 심각도 : 8.8높음 — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 구성 요소 : Linux 커널...
HeapCrypt
HeapCrypt Sleep을 후킹하고 힙을 암호화한 후 잠시 대기했다가 힙을 복호화하는 자체 함수로 Sleep을 수정하여, 잠자는 동안 힙을 암호화합니다: 16bit key xor heap encryption : 16bit key xor heap decryption : 참고 자료 : https://www.arashparsa.com/hook-heaps-and-live-free/...
DEBIAN-CVE-2026-47591
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memory protection due to incorrect authorization, enabling write access to memory marked read-only. A successful exploit of this vulnerability might lead to code...
EUVD-2026-90133
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memory protection due to incorrect authorization, enabling write access to memory marked read-only. A successful exploit of this vulnerability might lead to code...
CVE-2026-47591
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memory protection due to incorrect authorization, enabling write access to memory marked read-only. A successful exploit of this vulnerability might lead to code...
CVE-2026-47591
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memory protection due to incorrect authorization, enabling write access to memory marked read-only. A successful exploit of this vulnerability might lead to code...
CVE-2026-47591
The NVIDIA GPU Display Driver for Linux contains a vulnerability in its kernel mode layer . Due to incorrect authorization, an unprivileged user can bypass read-only memory protection to gain write access to memory marked as read-only. Successful exploitation could result in code execution , deni...
CVE-2026-47591
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memory protection due to incorrect authorization, enabling write access to memory marked read-only. A successful exploit of this vulnerability might lead to code...
USN-8849-1 linux-nvidia-tegra-5.15 vulnerabilities
It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...
USN-8818-4 linux, linux-nvidia vulnerabilities
It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...
Linux Distros Unpatched Vulnerability : CVE-2026-47591
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memory protection due to...
PT-2026-103439
Name of the Vulnerable Software and Affected Versions NVIDIA GPU Display Driver for Linux affected versions not specified Description An issue exists in the kernel mode layer where incorrect authorization allows an unprivileged user to bypass read-only memory protection. This flaw enables write...
USN-8818-3: Linux kernel vulnerabilities
It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...
USN-8818-2 linux-ibm-5.15 vulnerabilities
It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...