VectorKernel - PoCs For Kernelmode Rootkit Techniques Research

PoCs for Kernelmode rootkit techniques research or education. Currently focusing on Windows OS. All modules support 64bit OS only. NOTE Some modules use ExAllocatePool2 API to allocate kernel pool memory. ExAllocatePool2 API is not supported in OSes older than Windows 10 Version 2004. If you want...

The vulnerabilities of Mitsubishi Electric’s software products, including EZSocket, FR Configurator2, GT Designer3 Version1(GOT1000), GT Designer3 Version1(GOT2000), GX Works2, GX Works3, MELSOFT Navigator, MT Works2, MX Component, and MX OPC Server DA/UA (software included with MC Works64), are related to the use of external control inputs for class selection. This allows a malicious individual to execute arbitrary code.

The vulnerabilities of Mitsubishi Electric’s software products, including EZSocket, FR Configurator2, GT Designer3 Version1GOT1000, GT Designer3 Version1GOT2000, GX Works2, GX Works3, MELSOFT Navigator, MT Works2, MX Component, and MX OPC Server DA/UA software included with MC Works64, are relate...

CVE-2023-52271

The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any Protected Process Light process via an IOCTL which will be named at a later time...

Understanding Business Logic Abuse and Its Detection Challenges

Digital modernization and automation have been on a rapid trajectory for the last 5 years and were thrust forward at an even faster pace when the COVID-19 pandemic and subsequent lockdown period took hold in 2020. For businesses and consumers alike this acceleration of advanced technology...

CVE-2021-32933

MDT AutoSave (MDT Software) prior to v6.02.06 is affected by a command-injection vulnerability in the API that fails to validate input, enabling an attacker to pass a malicious file and manipulate the process creation command line to execute a malicious process. The issue is documented across mul...

CVE-2021-27570

CVE-2021-27570 affects Emote Remote Mouse (≤3.015). An attacker can remotely close any running process by sending the process name in a crafted packet. The affected communications are sent in cleartext and lack authentication, enabling network-based exploitation with low complexity and no privile...

Soroush IM Desktop app 0.15 - Authentication Bypass Vulnerability

Exploit for linux platform in category local exploits Exploit Title: Soroush IM Desktop app 0.15 - Authentication Bypass Exploit Author: VortexNeoX64 Vendor Homepage: https://soroush-app.ir Software Link: https://soroush-app.ir/UploadedData/Soroush.exe Version: 0.15 BETA Tested on: Windows 10 180...

CVE-2017-11746

Tenshi 0.15 creates a tenshi.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for tenshi.pid modification before a root script executes a "kill cat /pathname/tenshi.pid" command...

PDFMate PDF Converter Pro 1.7.5.0 - Buffer Overflow

Document Title: =============== PDFMate PDF Converter Pro 1.7.5.0 - Buffer Overflow References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2029 Release Date: ============= 2017-01-30 Vulnerability Laboratory ID VL-ID: ==================================== 2029...

IRONGATE ICS Malware: Nothing to See Here...Masking Malicious Activity on SCADA Systems

In the latter half of 2015, the FireEye Labs Advanced Reverse Engineering FLARE team identified several versions of an ICS-focused malware crafted to manipulate a specific industrial process running within a simulated Siemens control system environment. We named this family of malware IRONGATE...

Microsoft Internet Explorer CDXTFilterNode Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Rising the latest 0day vulnerabilities-vulnerability warning-the black bar safety net

Write into the program after double-click to run directly K off Swiss Star re-start.） The following is an exploit code ------------------------------------------------------------------------------ DWORD GetProcessIdFromNameLPCTSTR name PROCESSENTRY32 pe; DWORD id = 0; HANDLE hSnapshot =...

CVE-2008-5076

htop 0.7 writes process names to a terminal without sanitizing non-printable characters, which might allow local users to hide processes, modify arbitrary files, or have unspecified other impact via a process name with "crazy control strings."...

Ubuntu 6.06 LTS : linux-source-2.6.15 vulnerabilities (USN-508-1)

A buffer overflow was discovered in the Moxa serial driver. Local attackers could execute arbitrary code and gain root privileges. CVE-2005-0504 A flaw was discovered in the IPv6 stack's handling of type 0 route headers. By sending a specially crafted IPv6 packet, a remote attacker could cause a...

Mandrake Linux Security Advisory : apache (MDKSA-2007:140)

A vulnerability was discovered in the the Apache modstatus module that could lead to a cross-site scripting attack on sites where the server-status page was publically accessible and ExtendedStatus was enabled CVE-2006-5752. A vulnerability was found in the Apache modcache module that could cause...

linux/x86 examples of long-term payloads hide-wait-change 187 bytes+

Exploit for linux/x86 platform in category shellcode ==================================================================== linux/x86 examples of long-term payloads hide-wait-change 187 bytes+ ====================================================================...

linux/x86 examples of long-term payloads hide-wait-change 187 bytes+

linux/x86 examples of long-term payloads hide-wait-change 187 bytes+. Shellcode exploit for linx86 platform /---------------------------------------------------------------------------- Mystique Project: Examples of long-term payloads hide-wait-change code by [email protected] & [email protected]...

Cscope 15.5 - Symlink

/ RXcscope exploit version 15.5 and minor / include include include include define BSIZE 64 int mainint ac, char av pidt cur; uint i=0, lst; char bufferBSIZE + 1; fprintfstdout, "\n -- Cscope Exploit --\n"\ " version 15.5 and minor \n" \ " Gangstuck / Psirac\n" \ " \n\n"; if ac != 3 fprintfstderr...

FreeBSD 3.4 NetBSD 1.4.1 OpenBSD 2.6 - proc FileSystem

FreeBSD 3.4 NetBSD 1.4.1 OpenBSD 2.6 - proc FileSystem // source: https://www.securityfocus.com/bid/940/info Certain BSD derivative operating systems use an implantation of the /proc filesystem which is vulnerable to attack from malicious local users. This attack will gain the user root access to...

BSD 2.1 FTP.Core Local Exploit

FTP.CORE attack for BSD 2.1 ----------------------------------------------------------------------------------------------------------------- by The Bronc Buster [email protected] http://www2.succeed.net/bbuster Made for The Infected www.infected.com...