CVE-2022-3699

CVE-2022-3699 联想诊断驱动程序的访问控制不正确，允许低权限用户发出设备IOCTL，以执行任意物理/虚拟内存读写。 感谢ch3rn0byl的帮助（我100%完全借鉴了他的两个函数）。 说明 IOCTL 0x222000: rdmsr IOCTL 0x222008/0x22200C: HalGet/SetBusData IOCTL 0x222010: Read via MmMapIoSpace IOCTL 0x222014: Write via MmMapIoSpace 此IOCTL将从输入缓冲区提供的指针的值复制到映射的物理内存中 工作原理：...

XenoboxX

Hardware-Sandbox-Toolkit Malware setzt häufig Anti-VM-Techniken ein, deren Erkennung und Bekämpfung unterschiedlich schwierig sein kann. Obwohl die Integration von Anti-Erkennungsmaßnahmen in unseren Laboren eine häufig genutzte Option ist, sollten wir auch den Einsatz einer echten Hardware-Sandb...

CVE-2026-80810

A flaw was found in the Linux kernel. An integer overflow vulnerability in the iouring/rsrc component, specifically within the iovecfillbvec function, can lead to incorrect memory calculations when handling very large memory pages. This error causes the kernel to access memory outside of its...

CVE-2026-80887

A flaw was found in the drm/vmwgfx component of the Linux kernel. An integer overflow vulnerability exists in the vmwshaderdefine function due to improper validation of user-supplied shader window size and offset. When the offset value is close to its maximum, an unsigned addition can wrap around...

HandleKatz

HandleKatz 本工具是我们 Brucon2021 会议演讲的一部分实现，演示了利用 对 Lsass 的克隆句柄 来创建其混淆内存转储的方法。 它编译为一个完全位于其文本段 的可执行文件。因此，提取出的 PE 文件 .text 段是完全的位置无关代码（PIC），意味着它可以像任何 shellcode 一样被处理。 HandleKatz 在内存中执行时占用非常小的足迹，因为它本身不分配任何额外的可执行内存，因此可以有效地与如 @ForrestOrr 描述的 PhantomDLL-Hollowing 等概念结合使用。这与诸如 Donut、SRDI 或反射加载器等 PIC PE...

CVE-2026-80841

A flaw was found in the Linux kernel's net/packet component, specifically within the AFPACKET transmission ring. This vulnerability occurs because virtual memory allocated for network packet handling is prematurely released while active network buffers socket kernel buffers, or skbs still hold...

CVE-2026-80780

A flaw was found in the Linux kernel's Human Interface Device HID pidff driver. A remote attacker, by plugging in a specially crafted malicious USB device, can trigger an out-of-bounds write in the hidpidffinitwithquirks function. This occurs because the function fails to validate if the input li...

CVE-2026-80848

A flaw was found in the xfrm: espintcp component of the Linux kernel. A race condition exists during the closure of espintcp sockets, where a memory buffer skb can be freed while still being accessed by another process. This Use-After-Free UAF vulnerability could allow a local attacker to cause...

firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Internally found bugs present in Firefox 154, Firefox ESR 153.1 and Firefox ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume...

firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Internally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR 115.39. Some of these bugs showed evidence of memory corruption or another security-relevant...

Amnesiac

Amnesiac Amnesiac 是一个后渗透框架，旨在辅助在活动目录环境中的横向移动。 Amnesiac 的开发旨在弥补 Windows 操作系统上的一个空白，在该系统上，后渗透框架除非明确安装，否则不易获得。实际上，它完全用 PowerShell 编写，可以像其他任何 PowerShell 脚本一样在内存中加载和执行。 如果您觉得 Amnesiac 有价值并且喜欢这个项目，请考虑在 GitHub 上给我们一个星标。您的支持激励开发者继续改进和维护这个项目。 请阅读文档以充分利用 Amnesiac：https://leo4j.gitbook.io/amnesiac/ 加载与运行...

ATMMalScan

简介 ATMMalScan 是一款适用于 Windows 7 及以上版本操作系统的命令行工具，可帮助在数字取证与事件响应过程中搜索 ATM 上的恶意软件痕迹。该工具根据指定的文件路径，检查系统的运行进程以及硬盘。扫描系统时，拥有标准权限的用户即可胜任。不过，使用管理员权限运行 ATMMalScan 可获得最佳结果。 已知问题： 目前 ATMMalScan 不支持需要 Unicode 的代码页，这意味着设置为例如西里尔字母或中文等字符的 Windows 操作系统，无法保证呈现有效结果。 要求： 请确保待扫描的 ATM 上至少已安装 Visual C++ Redistributable fo...

CVE-2017-5123

CVE-2017-5123 Escalada de privilegios en Linux explotando la llamada al sistema waitid. El exploit es presentado por @XeR0x2A y @chaignc de HexpressoTeam únicamente con fines educativos. El error fue introducido el 21 de mayo de 2017 y corregido el 9 de octubre de 2017; se sabe que 4.14.0-rc4+ es...

patriot

Patriot Small research project for detecting various kinds of in-memory stealth techniques. Download the latest release here. The current version supports the following detections: Suspicious CONTEXT structures pointing to VirtualProtect functions. Targets research by Austin Hudson Foliage and Ek...

patriot

Patriot Pequeño proyecto de investigación para detectar diversas técnicas de sigilo en memoria. Descargue la última versión aquí. La versión actual admite las siguientes detecciones: Estructuras CONTEXT sospechosas que apuntan a funciones VirtualProtect. Apuntando a la investigación de Austin...

EUVD-2026-93560

ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized...

CVE-2026-106115

The ImageSharp 2D graphics library (versions 2.1.0 through 4.1.2 ) is vulnerable to an out-of-bounds write in the TIFF CCITT Group 4 encoder . The root cause is that T6BitCompressor.CompressStrip can emit encoded row data and end-of-facsimile-block codes exceeding the buffer size allocated by Wid...

CVE-2026-106115 ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer

ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode...

CVE-2026-106114

The ImageSharp 2D graphics library (versions 1.0.0-beta0001 through 4.1.2 ) is vulnerable to a memory allocation issue during ICC CLUT parsing . The root cause is that the library calculates allocation sizes using attacker-declared channel and grid dimensions without first verifying if the profil...

CVE-2026-106114 ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions

ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and...