11 matches found
Split
描述 分而治之是一种编程中常用的算法，通过将复杂的问题分解为许多更简单的子问题来解决它。我们可以将这种方法以不同的目标应用于进攻性安全：迷惑 EDR，使其无法跟踪我们的活动，从而阻止它们触发任何警报。这类似于最近在现实攻击中几乎任何钓鱼活动中都能看到的情况：长感染链，逐步运行多个文件（例如 .url - .one - .js - .bat - .dll），而不是直接运行最终载荷。每个被运行的文件都执行一个简单的任务（下载另一个文件、对注册表进行任何更改、在目录之间移动文件或更改其名称/扩展名等），单独来看很难将这些任务标记为恶意，以此来为最终执行准备环境。...
LsassReflectDumping
LsassReflectDumping 此工具利用 RtlCreateProcessReflection API 的进程分叉（Process Forking）技术来克隆 lsass.exe 进程。创建克隆后，使用 MINIDUMPCALLBACKINFORMATION 回调为克隆进程生成内存转储。 步骤 获取 Lsass.exe 进程的句柄 使用 RtlCreateProcessReflection（进程分叉）克隆 Lsass.exe 进程 使用 MINIDUMPCALLBACKINFORMATION 回调创建克隆进程的 minidump 确认转储的内容和大小。 终止克隆进程。 使用方法...
CVE-2025-61303
CVE-2025-61303 - RecordedFuture Triage：通过递归进程分叉实现拒绝分析 描述 RecordedFuture Triage 沙箱 Windows 10 build 2004 和 Windows 10 LTSC 2021 的 Windows 行为分析引擎中存在一个严重 漏洞，允许提交的恶意软件样本规避检测并导致拒绝分析 。当样本递归生成大量子进程时，会触发该漏洞，产生高日志量并耗尽系统资源。因此，关键恶意行为（包括 PowerShell 执行和反弹 Shell 活动）可能不会被记录或报告，从而误导分析人员，并损害沙箱分析结果的完整性和可用性。 CVSS 评...
CVE-2025-61301
CVE-2025-61301 - CAPEv2: 通过递归进程分叉实现的分析拒绝 描述 一个高严重性 的分析拒绝漏洞影响CAPEv2（提交52e4b43，2025-05-17）中的reporting/mongodb.py和reporting/jsondump.py，允许可以提交样本的攻击者通过生成深度嵌套或过大的行为数据来触发MongoDB BSON限制或orjson递归错误，从而导致行为分析报告不完整或缺失，当样本在沙箱中执行时。 CVSS评分 CVSS v3.1: 7.5 高 向量： CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 作者/研究...
CVE-2026-11625
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced...
CVE-2025-7394
In CVE-2025-7394, the OpenSSL compatibility layer’s RAND_poll() misbehavior can yield predictable random values from RAND_bytes() when fork() occurs, affecting only applications that call RAND_bytes() after forking (not internal TLS operations). WolfSSL implemented a complementary change so RAND_...
Nanodump - A Crappy LSASS Dumper With No ASCII Art
A flexible tool that creates a minidump of the LSASS process. 1. Features It uses syscalls with SysWhispers2 for most operations. Syscalls are called from an ntdll address to bypass some syscall detections. It sets the syscall callback hook to NULL. Windows APIs are called using dynamic invoke...
CVE-2017-17053
The initnewcontext function in arch/x86/include/asm/mmucontext.h in the Linux kernel before 4.12.10 does not correctly handle errors from LDT table allocation when forking a new process, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a...
CVE-2017-17053
The initnewcontext function in arch/x86/include/asm/mmucontext.h in the Linux kernel before 4.12.10 does not correctly handle errors from LDT table allocation when forking a new process, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a...
CVE-2016-2143
It was reported that on s390x, the fork of a process with four page table levels will cause memory corruption with a variety of symptoms. All processes are created with three level page table and a limit of 4TB for the address space. If the parent process has four page table levels with a limit o...
