concealed_code_execution

隠蔽されたコード実行 Hunt& Hackett は、Windows上でコード実行を隠蔽する攻撃手法を説明するツールセットと技術文書を提供しています。ここでは、これらの手法がどのように機能するかの説明、検出に関するアドバイス、そして検出範囲をテストするためのサンプルソースコードを入手できます。 目次 このリポジトリは、Windows内部メカニズムを多用する2つのクラスの攻撃手法をカバーし、それらを検出するための提案とツールを提供します。 Process Tampering - プロセス全体のスケールでコードを隠蔽する一連のテクニック。 Code Injection -...

RIPPL

RIPPL 无需驱动程序即可操纵受 PPL 保护的进程 该工具实现了一种 用户态 漏洞利用技术，用于操纵 Windows 受 PPL 保护的进程。该技术最初由 James Forshaw（又称 @tiraniddo）和 Clément Labro（又称 @itm4n）在以下博文中探讨。 James Forshaw 的博文 ：Windows Exploitation Tricks Clément Labro 的博文 第 1 部分 ：Do You Really Know About LSA Protection RunAsPPL? Clément Labro 的博文 第 2 部分...

CVE-2024-30088

CVE-2024-30088 This repository contains a Proof of Concept PoC written in Python for the vulnerability CVE-2024-30088. This code is an attempt to replicate the vulnerability as a technical exercise, with purely educational and demonstrative purposes, showing how Python somehow "struggles" also in...

invoker

Invoker Penetration testing utility and antivirus assessment tool. Built with Visual Studio Community 2022 v17.5.4 64-bit and tested on Windows 10 Enterprise OS 64-bit. Made for educational purposes. I hope it will help! This repository started to have known signatures and I don't have time to...

EDRKiller

EDRKiller 使用 cve-2026-36425 杀手级 EDR，可击杀 360 可击杀任何杀毒软件进程，包括但不限于 360 安全卫士和火绒安全。 我利用一个驱动程序漏洞进行进程操作，通过 NT 函数注册驱动程序。未实现隐藏功能。使用 Clang 编译，可绕过静态杀毒检测。 我利用一个驱动程序漏洞进行进程操作，通过 NT 函数注册驱动程序。 未实现隐藏功能。使用 Clang 编译，可绕过静态杀毒检测。 ⚠️ 免责声明： 此代码仅用于教育和安全研究目的 。 您只能在合法拥有并完全控制的硬件和系统上运行它。 未经授权对第三方系统使用可能违反当地网络安全法律，并带来相应的法律责任。...

sleepall

sleepall 基于 CVE-2024-28085 漏洞（https://people.rit.edu/sjf5462/6831711781/wall2272024.txt）的木马，该漏洞至今未在任何地方修复。原理：bash 支持转义码，我们可以控制终端中字符串的格式。木马监听进程并寻找 sudo 命令的 pid，找到其父进程并杀死根进程，同时植入伪造的 SUDO 提示行。 用户在终端执行 sudo 命令时，木马会修改其进程，强制让密码输入到终端而非 sudo。之后密码被发送至服务器。 此代码仅供测试和学习使用，作者不对您后续的任何行为负责。 Build: root@kitploit:...

EUVD-2026-51329

The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework TCF service that does not require any...

CVE-2026-12562

CVE-2026-12562 affects Toptech Systems RCU II+ and Multiload II+ devices. A network-accessible port runs a Target Communications Framework (TCF) service that does not require authentication, exposing a debug interface that grants full root access to the embedded Linux environment. An unauthentica...

TLSCheck 2.0: An Enhanced Memory Forensics Approach to Efficiently Detect TLS Callbacks

Memory analysis is a crucial technique in digital forensics that enables investigators to examine the runtime state of a system through physical memory dumps. While significant advances have been made in memory forensics, the detection and analysis of Thread Local Storage TLS callbacks remain...

CVE-2026-25752

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attacker to modify device tags via WebSockets. Exploitation allows an unauthenticated, remote attacker to bypass role-based access controls and...

CVE-2021-27569

An issue was discovered in Emote Remote Mouse through 4.0.0.0. Attackers can maximize or minimize the window of a running process by sending the process name in a crafted packet. This information is sent in cleartext and is not protected by any authentication logic...

CVE-2018-25146

CVE-2018-25146 affects Microhard Systems IPn4G v1.1.0. Multiple connected docs confirm an undocumented vulnerability that allows authenticated attackers to list and manipulate running system processes by using a hidden feature to send arbitrary signals to kill background processes and system serv...

CVE-2025-67792

DriveLock is affected in versions 24.1 (before 24.1.6), 24.2 (before 24.2.7), and 25.1 (before 25.1.5). The issue allows local unprivileged users to manipulate a DriveLock process on Windows to execute arbitrary commands. Root cause details are not fully disclosed in the provided excerpts, but mu...

CVE-2025-59694

The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 patched in 13.6.12 LTS and 13.9.0 STS, allows a physically proximate attacker to persistently modify firmware and influence the insecurely configured appliance boot process. To exploi...

EUVD-2021-19654

Malware in sbrugna...

EUVD-2019-13227

Malware in sbrugna...

EUVD-2017-6181

Malware in sbrugna...

CVE-2025-50503

A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password mechanism. By manipulating the reset process, an unauthorized user may be able to reset the password and gain access to the account without needing to provide ...

Docker Desktop < 4.41.0 Privilege Escalation

The version of Docker Desktop for Windows is prior to 4.41.0. It is therefore affected by a privilege escalation vulnerability. A vulnerability in the update process of Docker Desktop for Windows versions prior to 4.41.0 could allow a local, low-privileged attacker to escalate privileges to SYSTE...

CVE-2025-25244 Missing Authorization Check in SAP Business Warehouse (Process Chains)

SAP Business Warehouse Process Chains allows an attacker to manipulate the process execution due to missing authorization check. An attacker with display authorization for the process chain object could set one or all processes to be skipped. This means corresponding activities, such as data...