shad0w

SHAD0W SHAD0W es un framework C2 modular diseñado para operar con éxito en entornos maduros. Utiliza una variedad de métodos para evadir EDR y AV, permitiendo al operador seguir usando las herramientas y técnicas que conoce. Está impulsado por Python 3.8 y C, y usa Donut para la generación de...

fake-sandbox

Fake Sandbox Processes FSP This small script will simulate fake processes of analysis, sandbox and VM software that some malware will try to avoid. You can download the original script made by @x0rz here thanks, by the way. You can also download my slightly optimized script from the root director...

STProcessMonitorBYOVD

STProcessMonitorBYOVD Reference: https://bbs.kafan.cn/thread-2288675-1-1.html Usage: 1. Place the vulnerable driver under the same directory of the exe. The version 11.11.4.0 the older one is with CVE-2025-70795 / CVE-2026-0828, compatible with the parameter /Kill; The version 11.26.18 Updated is...

0xKern3lCrush

0xKern3lCrush Windows BYOVD research on two real cases: the Safetica ProcessMonitorDriver CVE-2026-0828 and the ThrottleStop driver abused by MedusaLocker CVE-2025-7771. The repository documents the exposed interfaces, the privileged outcome each one reaches, and how to detect the abuse. It ships...

tarian

Tarian Protege tus aplicaciones ejecutándose en Kubernetes de ataques maliciosos pre-registrando tus procesos confiables y firmas de archivos confiables. Tarian detectará procesos desconocidos y cambios en los archivos registrados, luego enviará alertas y tomará una acción automatizada. ¡Protege ...

Chrome-Skia-CVE-2024-8636

Fixed in Chrome M128: https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop10.html Steps to reproduce: 1. Apply the chromium.diff patch to chromium. 2. Run genskpic.py to generate drawablepicture.skp.hh, then move the generated file to src/gpu/commandbuffer/client. 3...

CVE-2023-32784-kdbxpassdmp

keepassdumper.py Puerto en Python de vdohney/keepass-password-dumper CVE-2023-32784 — todo el crédito de la implementación original en C y de la técnica subyacente pertenece a vdohney. El script escanea un volcado de memoria de un proceso en busca de las cadenas de renderizado residuales que el...

CVE-2019-11043

CVE-2019-11043 0th3rs Security Team ====================== In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 Tested under PHP 7.2.20/7.3.10 Instructions 1、较为稳定,只要爆破出query长度和Header头字段长度 2、autosession检测漏洞存在性 3、实现判断目标worker进程数实现健壮性 4、全worker进程污染 Nginx configuration locati...

fpicker

fpicker fpicker is a Frida-based fuzzing suite that offers a variety of fuzzing modes for in-process fuzzing, such as an AFL++ mode or a passive tracing mode. It should run on all platforms that are supported by Frida. Installation Instructions Building and Running Creating a Fuzzing Harness Mode...

CVE-2019-12594

CVE-2019-12594 This is a PoC for CVE-2019-12594, a vulnerability in DOSBox 0.74-2. Launching a calculator on the host from DosBox 0.74-2 The PoC for this vulnerability has been tested with the following configuration: DOSBox 0.74-2 Debian 10 amd64 Libc6 2.28-10...

BYOVD

EnPortv-Killer PoC for vulnerability in EnPortv driver from EnCase As of 2026-07-10, the driver is listed onLOLDDrivers but remains absent from Microsoft's recommended driver block rules as of 2026-07-10 Built on byovd-lib -- implements the DriverConfig trait and delegates the full BYOVD flow to...

CVE-2025-22457

CVE-2025-22457 CVE-2025-22457: Python Exploit POC Scanner to Detect Ivanti Connect Secure RCE This script helps identify Ivanti Connect Secure, Policy Secure, or ZTA Gateways that may be vulnerable to CVE-2025-22457 , a critical unauthenticated stack-based buffer overflow in the web process...

bdapiutil-bydov

BdApiUtil64.sys BYOVD C++ demonstration tool for Windows that interacts with the BdApiUtil device via DeviceIoControl and a specific IOCTL to request the termination of a process. Requirements 64-bit Windows 10/11 Visual Studio / MSVC BdApiUtil64.sys driver loaded and accessible Administrative...

inject-assembly

inject-assembly - 기존 프로세스에서 .NET 실행 이 도구는 Cobalt Strike의 전통적인 fork and run 실행 방식에 대한 대안입니다. 로더는 현재 Beacon을 포함한 모든 프로세스에 주입될 수 있습니다. 오래 실행되는 어셈블리는 계속 실행되며, execute-assembly의 동작과 유사하게 출력을 Beacon으로 다시 보냅니다. inject-assembly는 두 가지 구성 요소로 이루어져 있습니다: 1. BOF initializer : 인수와 함께 원격 프로세스에 어셈블리 로더를 주입하는 소형...

aes-finder

AES Finder Utilidad para encontrar claves AES en la memoria de procesos en ejecución. Funciona para claves de 128, 192 y 256 bits. Uso Abra la solución aes-finder.sln en Visual Studio 2013 para compilar el código fuente. Alternativamente, use gcc/clang: g++ -O3 -march=native -fomit-frame-pointer...

nginx-map-risk-audit

CVE-2026-42533: NGINX Map Regex Risk Review Defensive research note on CVE-2026-42533, a heap buffer overflow in NGINX request processing tied to map directives with regex captures and certain variable evaluation patterns. In plain English: NGINX is web server and reverse proxy software. It often...

herpaderping

Process Herpaderping png.HerpaderpIcon Process Herpaderping es un método para ocultar las intenciones de un proceso modificando el contenido en disco después de que la imagen haya sido mapeada. Esto resulta en un comportamiento curioso por parte de los productos de seguridad y del propio sistema...

azazel

Azazel V 0.1 Toda la tierra ha sido corrompida mediante las obras que fueron enseñadas por Azazel: a él atribuye todo pecado. -- 1 Enoc 2:8 Azazel es un rootkit de espacio de usuario basado en la técnica original LDPRELOAD del rootkit Jynx. Es más robusto y tiene características adicionales, y se...

ppid-spoofing

Detección de la suplantación de PID padre https://www.countercept.com/blog/detecting-parent-pid-spoofing/...

doublepulsar-usermode-injector

Autor: Matt Hillman [email protected] - @sp1nl0ck Empresa: Countercept @countercept Sitio web: https://countercept.com Una utilidad que usa el shellcode en modo usuario de la carga útil de DOUBLEPULSAR para cargar de forma reflectiva un DLL arbitrario en otro proceso, para su uso en la prueb...