Portable Executable Files With Weak Encryption (CVE-2013-3900)

Portable Executable PE files can contain encrypted data. PE files with weak data encryption can be decrypted to manipulate the data. There are cases in which certain traffic, although not intended for malicious use, is very unsafe, since it may transfer shellcode which is undetectable by IPS...

Adobe Acrobat Reader - ASLR + DEP Bypass with Sandbox Bypass

CVE-2013-0640/1 Somehow, our script got on to the Russian forums :/ @w3bd3vil and @abh1sek Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29881.tar.gz Adobe Acrobat Reader ASLR/DEP bypass Exploit with SANDBOX BYPASS...

Перенос таблицы импорта

Всем привет! В этой статье я расскажу о работе с исполняемыми файлами PE-формата, а именно о работе с таблицей импорта. Возникла необходимость перенести таблицу импорта. Перенести в другую секцию, либо в пределах одной секции. В данном случае перенос таблицы импорта осуществляется в пределах одно...

[The Backdoor Factory] Backdoors win32 PE files

Backdoors win32 PE files, to continue normal file execution if the shellcode supports it, by patching the exe/dll directly. Some executables have built in protections, as such this will not work on all PE files. It is advisable that you test target PE files before deploying them to clients or usi...

[Pyew v2.2] A Python tool for static malware analysis

Pyew is a command line python tool to analyse malware. It does have support for hexadecimal viewing, disassembly Intel 16, 32 and 64 bits, PE and ELF file formats it performs code analysis and let you write scripts using an API to perform many types of analysis, follows direct call/jmp instructio...

CVE-2012-6558

Heap-based buffer overflow in HeavenTools PE Explorer 1.99 R6 allows remote attackers to execute arbitrary code via the size value for a string in the resource section of a Portable Executable PE file...

Heap overflow

Heap-based buffer overflow in Resource Hacker 3.6.0.92 allows remote attackers to execute arbitrary code via a Portable Executable PE file with a resource section containing a string that has many tab or line feed characters...

Heap overflow

Heap-based buffer overflow in HeavenTools PE Explorer 1.99 R6 allows remote attackers to execute arbitrary code via the size value for a string in the resource section of a Portable Executable PE file...

CVE-2012-6558

HeavenTools PE Explorer 1.99 R6 is affected by a heap-based buffer overflow in the resource section of a Portable Executable, triggered by the size value for a string. This allows remote code execution. Documents in NVD/NVD mirrors confirm the issue but do not provide explicit exploit details or ...

CVE-2012-6558

Heap-based buffer overflow in HeavenTools PE Explorer 1.99 R6 allows remote attackers to execute arbitrary code via the size value for a string in the resource section of a Portable Executable PE file...

CVE-2012-6553

Heap-based buffer overflow in Resource Hacker 3.6.0.92 allows remote attackers to execute arbitrary code via a Portable Executable PE file with a resource section containing a string that has many tab or line feed characters...

DEBIAN-CVE-2013-2020

Integer underflow in the cliscanpe function in pe.c in ClamAV before 0.97.8 allows remote attackers to cause a denial of service crash via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an out-of-bounds read...

CVE-2013-2020

Integer underflow in the cliscanpe function in pe.c in ClamAV before 0.97.8 allows remote attackers to cause a denial of service crash via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an out-of-bounds read...

Integer overflow

Integer underflow in the cliscanpe function in pe.c in ClamAV before 0.97.8 allows remote attackers to cause a denial of service crash via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an out-of-bounds read...

CVE-2013-2020

Integer underflow in the cliscanpe function in pe.c in ClamAV before 0.97.8 allows remote attackers to cause a denial of service crash via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an out-of-bounds read...

CVE-2013-2020

Integer underflow in the cliscanpe function in pe.c in ClamAV before 0.97.8 allows remote attackers to cause a denial of service crash via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an out-of-bounds read...

[REMnux] A Linux Distribution for Malware Analysis

REMnux incorporates a number of tools for analyzing malicious executables that run on Microsoft Windows, as well as browser-based malware, such as Flash programs and obfuscated JavaScript. This popular toolkit includes programs for analyzing malicious documents, such PDF files, and utilities for...

BloXor - A Metamorphic Block Based XOR Encoder

A Metamorphic Block Based XOR Encoder. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/encoder/bloxor/bloxor' BloXor is a cross architecture metamorphic block based xor encoder/decoder for Metasploit...

[VSD] (Virtual Section Dumper) Just another Virtual Section Dumper for Windows Processes

What's VSD? VSD Virtual Section Dumper is intented to be a tool to visualize and dump the memory regions of a running 32 bits or a 64 bits process in many ways. For example, you can dump the entire process and fix the PE Header , dump a given range of memory or even list and dump every virtual...

Smadav Anti Virus 9.1 - Crash (PoC)

Smadav Anti Virus 9.1 - Crash PoC Exploit Title: Smadav AntiVirus - Crash PoC Date: 10/Nov/2012 Exploit Author: Mada R Perdhana [email protected] / Spentera Research Team Vendor Homepage: http://www.smadav.net & http://www.smadav.web.id Software Link: http://www.smadav.net/download Version: 9.1...