Process-Dump

Process Dump Process Dump is a Windows reverse-engineering command-line tool to dump malware memory components back to disk for analysis. Often malware files are packed and obfuscated before they are executed in order to avoid AV scanners, however when these files are executed they will often...

WSASS

WSASS Это инструмент, использующий старую программу WerfaultSecure.exe для дампа памяти процессов, защищённых PPL Protected Process Light, таких как LSASS.EXE. Вывод сохраняется в формате Windows MINIDUMP. Этот инструмент автоматически заменяет магический заголовок"MDMP" на магический заголовок...

PPLFaultDumpBOF

Это производная работа от https://github.com/gabriellandau/PPLFault. Пожалуйста, посмотрите этот репозиторий, чтобы получить всю исходную информацию и дополнительные сведения. Эта конвертация намеренно не изменяет IOC исходного релиза инструмента. PPLFaultDumpBOF Объединяет оригинальный PPLFault ...

Improper Restriction of Communication Channel to Intended Endpoints

Overview Affected versions of this package are vulnerable to Improper Restriction of Communication Channel to Intended Endpoints in the custom netstack implementation. An attacker can access internal services or execute unauthorized actions by recovering a Wireguard private key from a process dum...

Improper Restriction of Communication Channel to Intended Endpoints

Overview Affected versions of this package are vulnerable to Improper Restriction of Communication Channel to Intended Endpoints in the custom netstack implementation. An attacker can access internal services or execute unauthorized actions by recovering a Wireguard private key from a process dum...

PPLBlade - Protected Process Dumper Tool

Protected Process Dumper Tool that support obfuscating memory dump and transferring it on remote workstations without dropping it onto the disk. Key functionalities : 1. Bypassing PPL protection 2. Obfuscating memory dump files to evade Defender signature-based detection mechanisms 3. Uploading...

MemTracer - Memory Scaner

MemTracer is a tool that offers live memory analysis capabilities, allowing digital forensic practitioners to discover and investigate stealthy attack traces hidden in memory. The MemTracer is implemented in Python language, aiming to detect reflectively loaded native .NET framework Dynamic-Link...

Information disclosure

Cleartext Storage of Sensitive Information in Memory vulnerability in Microsoft Windows client in McAfee True Key TK prior to 6.2.109.2 allows a local user logged in with administrative privileges to access to another user’s passwords on the same machine via triggering a process dump in specific...

CVE-2020-7299 Sensitive Data Exposure vulnerability in McAfee True Key Windows Client

Cleartext Storage of Sensitive Information in Memory vulnerability in Microsoft Windows client in McAfee True Key TK prior to 6.2.109.2 allows a local user logged in with administrative privileges to access to another user’s passwords on the same machine via triggering a process dump in specific...

CVE-2020-7299

CVE-2020-7299 affects the McAfee True Key Windows client. The vulnerability is a cleartext storage of sensitive information in memory, enabling a local administrator to access another user’s passwords on the same machine by triggering a process dump. Affected are True Key versions prior to 6.2.10...

CVE-2020-7299: Insufficiently Protected Credentials

Cleartext Storage of Sensitive Information in Memory vulnerability in Microsoft Windows client in McAfee True Key TK prior to 6.2.109.2 allows a local user logged in with administrative privileges to access to another user’s passwords on the same machine via triggering a process dump in specific...

Process Heap Analysis Framework: Python Haystack

Process Heap Analysis Framework python-haystack is an heap analysis framework, focused on searching and reversing of C structure in allocated memory. The first function/API is the SEARCH function. It gives the ability to search for known record types in a process memory dump or live process’s...

PT-1990-1002 · Hewlett Packard · Vms

Name of the Vulnerable Software and Affected Versions: VMS versions 4.0 through 5.3 Description: The issue allows local users to gain privileges. This is achieved via the ANALYZE/PROCESS DUMP DCL command. Recommendations: For VMS versions 4.0 through 5.3, consider restricting access to the...