ubuntils

ubuntils Forensic triage for live Ubuntu systems — automated artifact collection, persistence detection, and guided remediation in about a minute. The Problem When you suspect a Linux system is compromised, the first 30-40 minutes are usually spent running the same ten commands in sequence: check...

CVE-2024-22774

Panoramic Dental Imaging Software 9.1.2.7600. Phantom DLL Hijack Privilege Escalation CVE-2024-22774 Table of Contents Table of Contents Introduction Final Version of the Software Searching for Hijackable DLL Setting up the attack Exploit Persistance after OS install Introduction Originally, this...

NoFaxGiven

NoFaxGiven - Code Execution & Persistence in NETWORK SERVICE FAX Service A fax routing extension is a DLL that adds routing functionality to the fax service. Multiple fax routing extensions can reside on one server. When the fax server receives a fax transmission, it routes the received document...

slot2

slot2 slot2: a two-stage UEFI GRUB2 bootkit that persists a pre-OS networked implant on Amazon Linux 2023 on AWS EC2 UEFI x8664. by cenobyte [email protected] 2026 https://github.com/cenobyte-vincit/slot2 Summary slot2 is a bootkit for Amazon Linux 2023 on EC2. The AWS EC2 UEFI firmware load...

Burp-Recordadora

🧙‍♂️ Recordadora Recordadora is a BurpSuite extension inspired by Harry Potter. Like Neville's Remembrall, it helps you not to forget or lose context of your tests. ✨ Features Save and restore Proxy history Export and import Repeater requests Persist Intruder payloads Support for .log files to...

veneficus-implant-public

Veneficus Mini - Full kill-chain malware 0day: Exploit, LPE, Pivot, C2, Persistence Full kill-chain malware 0day: Exploit, LPE, Pivot, C2, Persistence Public technical outline · pseudo-code only · not executable abraxaslabs.tech · @abraxasnull Veneficus Mini is Full kill-chain malware 0day:...

SharPersist

SharPersist Windows persistence toolkit written in C. For detailed usage information on each technique, see theWiki. Author - Brett Hawkins @h4wkst3r Release Public version 1.0.1 of SharPersist can be found in the Releases section Installation/Building Pre-Compiled Use the pre-compiled binary in...

blackpill

BlackPill BlackPill is a stealthy Linux rootkit made in Rust. Features The rootkit is composed of multiple modules talking about Rust modules, not kernel modules: defense evasion : hide files, processes, network connections, etc. hooking : hook syscalls and IDT hypervisor : create a virtual machi...

Linux Distros Unpatched Vulnerability : CVE-2026-61725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker- supplied 7z archive can write or overwrite files outside...

AfterLife

AFTERLIFE Revocation Persistence Detection Lab When the password reset succeeds but the attacker never leaves. A local red/blue lab for one vulnerability class: the credential that outlives the event that was supposed to kill it. It ships the exploit, the root cause, the fix, a three-rule detecti...

DEBIAN-CVE-2026-61725

sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.joinentry.name without normalizin...

CVE-2026-61725

sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.joinentry.name without normalizin...

EUVD-2026-114537

sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.joinentry.name without normalizin...

CVE-2026-61725

The sevenz-rust2 Rust-native 7z compressor/decompressor (prior to version 0.21.1 ) is vulnerable to a path traversal issue in src/util/decompress.rs. The decompress_impl function fails to normalize UTF-16 entry names or verify containment when computing destination paths using dest.join(entry.nam...

CVE-2026-61725 sevenz-rust2: unchecked 7z entry paths permit traversal and absolute-path file overwrites

sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.joinentry.name without normalizin...

CVE-2026-61725 sevenz-rust2: unchecked 7z entry paths permit traversal and absolute-path file overwrites

sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.joinentry.name without normalizin...

CVE-2026-61725

sevenz-rust2 is a Rust-native 7z compressor and "decompress"or. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In "src/util/decompress.rs", "decompressimpl" computes each destination with "dest.joinentry.name" without...

CVE-2026-61725 sevenz-rust2: unchecked 7z entry paths permit traversal and absolute-path file overwrites

sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.joinentry.name without normalizin...

npm-incident-response

npm-incident-response English | Português Standalone scanner for the keyv/cacheable supply-chain incident "Shai-Hulud: Here We Go Again", Aug 4 2026 — 440+ npm packages compromised by a self-propagating worm that steals cloud/CI credentials and plants persistence with a dead-man's switch. Detects...

veneficus

@abraxasnull · [email protected] · abraxaslabs.tech · github.com/abraxas/veneficus Credit: @YoSoth0 Write-up: https://abraxaslabs.tech/research/veneficus Veneficus Mini v3.0 Windows 10/11 x64 implant kit: a PowerShell stager , a Rust PE , and a Cloudflare Worker that pages the operator on...