685 matches found
SharpKiller
SharpKiller AMSI-Killer@ZeroMemoryEx를 .NET Framework 4.8로 포팅한 평생lifetime AMSI 우회 도구. 추가 난독화 필요 https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=VirTool:MSIL/SharpKiller.A&ThreatID=2147895059 새로 통합된 기능: x - 0.5초마다 새 PowerShell 프로세스 실시간 검사 - 새 PowerShell 인스턴스 자동 패치...
sandsifter
s a n d s i f t e r : the x86 processor fuzzer Overview The sandsifter audits x86 processors for hidden instructions and hardware bugs, by systematically generating machine code to search through a processor's instruction set, and monitoring execution for anomalies. Sandsifter has uncovered secre...
shellme
shellme 때로는 셸코드와 opcode를 빠르게 필요로 할 때가 있기 때문입니다. 기본적으로 몇 가지 nasm/objdump 호출을 깔끔한 스크립트 하나로 감싸는 것뿐입니다. bryan@devbox:/shellme$ python shellme.py usage: shellme.py -h -n FILE -o OUTPUT -i INSTRUCTION -a ARCH optional arguments: -h, --help show this help message and exit -n FILE nasm or object file -o...
shellnoob
ShellNoob Writing shellcodes has always been super fun, but some parts are extremely boring and error prone. Focus only on the fun part, and use ShellNoob! For a quick overview, check the slides for the Black Hat Arsenal talk: link Want to contribute? Feature request? Bug report? Swears? All...
Amsi-Killer
生涯 AMSI バイパス オペコードスキャン 各命令の最初のバイトを検索することでジャンプ命令の正確なアドレスを取得します。この手法は、対象データセットの更新や変更があった場合でも有効です。 例： | 48:85D2 | test rdx, rdx | | 74 3F | je amsi.7FFAE957C694 | | 48 : 85C9 | test rcx, rcx | | 74 3A | je amsi.7FFAE957C694 | | 48 : 8379 08 00 | cmp qword ptr ds : rcx + 8 , 0 | | 74 33 | je...
NashaVM
NashaVM - Native Sharp Virtual Machine Nasha는 .NET 파일을 위한 가상 머신이며, 그 런타임은 C++/CLI로 작성되었습니다. 설치 git clone https://github.com/Mrakovic-ORG/NashaVM --recurse cd NashaVM\NashaVM nuget restore msbuild 종속성 dnlib .NET Framework Visual C++ 재배포 가능 패키지 FAQ 이 프로젝트는 무엇을 위한 것인가요? 이 프로젝트는 관리되는 opcode를 혼합 엔진 내부...
CVE-2020-25478--ASUS-RT-AC87U-TFTP-is-vulnerable-to-Denial-of-Service-DoS-attack
ASUS-RT-AC87U-TFTP-서비스-거부DoS-공격에-취약함 CVE-2020-25478 - ASUS RT-AC87U TFTP는 서비스 거부DoS 공격에 취약합니다 1. 영향을 받는 제품 및 버전 ASUS RT-AC87U 3.0.0.4.38251640 2. 문제 유형 주로 CWE-20과 관련이 있으며, ASUS RT-AC87U에서 실행되는 TFTP 서비스는 잘못된 opcode가 전송될 때 서비스 거부DoS 공격에 취약합니다. 다음 파이썬 코드 스니펫은 취약점 테스트에 사용됩니다: import socket import sys...
DeadDialect
DeadDialect 매 부팅은 다른 언어를 말한다. 어제의 바이너리는 오늘의 죽은 코드다. 세션 고유의 RISC-V ISA 재매핑 시스템. 시스템이 부팅될 때마다 명령어 집합의 새로운 암호화 순열을 생성합니다. 한 세션용으로 컴파일된 바이너리는 다음 세션에서 암호학적으로 거부됩니다. 재부팅 후에도 살아남는 멀웨어는 실행될 수 없습니다 — 죽은 방언을 말하기 때문입니다. 아이디어 표준 ISA는 고정된 계약입니다. 모든 프로그램, 모든 라이브러리, 모든 멀웨어는 0x13의 의미, syscall 64의 기능, 스택 포인터가 어떤...
Linux Distros Unpatched Vulnerability : CVE-2026-97942
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - x86/alternatives: Exclude text poking against changepageattr From time to time, the following BUG can be observed in the x86 alternatives patching code 0: kern...
PT-2026-98078
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access issue exists within the ACPICA component. This occurs due to missing boundary checks in the acpi ps get next namestring and acpi ps peek opcode functions...
PT-2026-98085
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow exists in the ACPICA component within the acpi ex opcode 3A 1T 1R mid op function. The issue occurs when calculating the truncation length due to a lack of overflow...
CVE-2026-19204
A flaw was found in Jetty. A remote attacker can exploit this vulnerability by sending a specially crafted WebSocket frame with an unknown operation code opcode and a very large declared payload length. When auto-fragmentation is enabled, these unknown opcodes bypass the normal maximum frame size...
Updated libpcap packages fix security vulnerabilities
OOBR and OOBW in libpcap before 1.10.7. CVE-2026-0799 abort in libpcap before 1.10.7 on an invalid BPF opcode. CVE-2026-31911 OOBR in libpcap before 1.10.7. CVE-2026-31912 Division by zero in libpcap before 1.10.7. CVE-2026-6244 Infinte loop in libpcap before 1.10.7. CVE-2026-6554 rpcapd memory...
kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing
A flaw was found in the Linux kernel's Soft RoCE RDMA/rxe driver. An unauthenticated remote attacker can send a specially crafted UDP packet with an unknown opcode to trigger an out-of-bounds read. This vulnerability can lead to a kernel panic, effectively causing a Denial of Service DoS on the...
CVE-2026-79993
The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...
UBUNTU-CVE-2026-79993
The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...
CVE-2026-79993
The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...
Astra Linux – Vulnerability in Linux 5.10, Linux
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fixed the issue where immediate work requests were flushed to the completion queue prematurely. The opcode of the send queue element was correctly set during the flushing of immediate work requests in the post-sendqueue...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: net: lapbether: Fixed an issue with invalid opcode in lapbethopen. If lapbregister fails when the lapb device goes online for the first time, the NAPI is not disabled. As a result, the invalid opcode issue is reported when the la...