43 matches found
concealed_code_execution
Скрытое выполнение кода Hunt& Hackett представляет набор инструментов и технических статей, описывающих атакующие техники, основанные на сокрытии выполнения кода в Windows. Здесь вы найдете объяснения принципов работы этих техник, рекомендации по обнаружению и примеры исходного кода для проверки...
invoker
Invoker Penetration testing utility and antivirus assessment tool. Built with Visual Studio Community 2022 v17.5.4 64-bit and tested on Windows 10 Enterprise OS 64-bit. Made for educational purposes. I hope it will help! This repository started to have known signatures and I don't have time to...
EDRKiller
EDRKiller Use cve-2026-36425 killer edr，360 can killer Kills any antivirus processes, including but not limited to 360 Security and Huorong Security. I am exploiting a driver vulnerability for process manipulation, registering the driver via NT‑functions. No hiding is implemented. Compiled with...
PT-2026-104017
Name of the Vulnerable Software and Affected Versions Kasa EC70 v4 Kasa EC71 v4 Description The production debug interface is not logically disabled at the firmware or chip level, and the bootloader remains unlocked. An attacker with physical access can restore physically severed debug traces to...
sleepall
sleepall CVE-2024-28085https://people.rit.edu/sjf5462/6831711781/wall2272024.txt 취약점에 기반한 트로이 목마로, 아직 어디에서도 수정되지 않았습니다. 요점: bash는 이스케이프 코드를 지원하며 터미널에서 문자열의 형태를 제어할 수 있습니다. 트로이 목마는 프로세스를 모니터링하여 sudo 명령어의 PID를 찾고, 그 부모를 알아내어 루트를 죽이고 가짜 SUDO 문자열을 대체합니다. 터미널의 사용자가 sudo 명령을 실행하면, 트로이 목마는 프로세스를 변조하여...
RIPPL
RIPPL 드라이버를 사용하지 않고 PPL 보호 프로세스 조작하기 이 도구는 Windows PPL 보호 프로세스를 조작하기 위한 사용자 영역 익스플로잇을 구현합니다. 이 기술은 원래 James Forshaw일명 @tiraniddo와 Clément Labro일명 @itm4n가 다음 블로그 게시물에서 처음 논의했습니다. James Forshaw의 블로그 게시물 : Windows 익스플로잇 트릭 Clément Labro의 블로그 게시물 파트 1 : LSA 보호RunAsPPL에 대해 정말 알고 계십니까? Clément Labro의 블...
CVE-2024-30088
CVE-2024-30088 이 저장소는 CVE-2024-30088 취약점에 대한 Python 기반 Proof of ConceptPoC을 포함하고 있습니다. 이 코드는 기술적 연습과 순수한 교육 및 시연 목적으로 취약점을 재현하려는 시도이며, Python이 이 분야에서 어떻게든 "버벅거리는" 모습을 보여줍니다. 저수준 데이터 구조를 정의하기 위해 ctypes 라이브러리를 사용했습니다. CVE-2024-30088은 Windows 커널에 영향을 미치는 권한 상승LPE 취약점입니다. 익스플로잇은 일반적으로 Python이 잘 지원하지 ...
PT-2026-78318
As an inadvertent side effect of an unrelated code change, PRIV KTRACE was always denied to a jailed root user. Tracing configured by a jailed root user was therefore not flagged as privileged. An unprivileged user in a jail that has permission to debug the target process can modify the jailed ro...
EUVD-2026-51329
The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework TCF service that does not require any...
CVE-2026-12562
The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework TCF service that does not require any...
CVE-2026-12562
CVE-2026-12562 affects Toptech Systems RCU II+ and Multiload II+ devices. A network-accessible port runs a Target Communications Framework (TCF) service that does not require authentication, exposing a debug interface that grants full root access to the embedded Linux environment. An unauthentica...
TLSCheck 2.0: An Enhanced Memory Forensics Approach to Efficiently Detect TLS Callbacks
Memory analysis is a crucial technique in digital forensics that enables investigators to examine the runtime state of a system through physical memory dumps. While significant advances have been made in memory forensics, the detection and analysis of Thread Local Storage TLS callbacks remain...
CVE-2026-25752
FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attacker to modify device tags via WebSockets. Exploitation allows an unauthenticated, remote attacker to bypass role-based access controls and...
CVE-2021-27569
An issue was discovered in Emote Remote Mouse through 4.0.0.0. Attackers can maximize or minimize the window of a running process by sending the process name in a crafted packet. This information is sent in cleartext and is not protected by any authentication logic...
CVE-2018-25146
CVE-2018-25146 affects Microhard Systems IPn4G v1.1.0. Multiple connected docs confirm an undocumented vulnerability that allows authenticated attackers to list and manipulate running system processes by using a hidden feature to send arbitrary signals to kill background processes and system serv...
CVE-2025-67792
DriveLock is affected in versions 24.1 (before 24.1.6), 24.2 (before 24.2.7), and 25.1 (before 25.1.5). The issue allows local unprivileged users to manipulate a DriveLock process on Windows to execute arbitrary commands. Root cause details are not fully disclosed in the provided excerpts, but mu...
CVE-2025-59694
The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 patched in 13.6.12 LTS and 13.9.0 STS, allows a physically proximate attacker to persistently modify firmware and influence the insecurely configured appliance boot process. To exploi...
EUVD-2021-19654
Malware in sbrugna...