Phantom-Evasion-Loader

SROP-Assisted Cross-Memory Attach CMA Injection via Direct Syscalls. 👻 Phantom-Evasion-Loader x64 Linux Phantom-Evasion-Loader is a standalone, pure x64 Assembly injection engine engineered to minimize the detection surface of modern EDR/XDR solutions and Kernel-level monitors like Falco eBPF. It...

Linux proc_mem / vm_writev Evasion

Generate a Linux x64 ELF that injects shellcode via processvmwritev or /proc/pid/mem instead of PTRACEPOKEDATA — fewer ptrace write traces. !/usr/bin/env python3 -- coding: utf-8 -- """ /proc/pid/mem and processvmwritev injection evasion. Spawns a host process, remote-mmaps via ptrace syscall...

CVE-2022-49171

In the Linux kernel, the following vulnerability has been resolved: ext4: don't BUG if someone dirty pages without asking ext4 first unpinuserpagesremote is dirtying pages without properly warning the file system in advance. A related race was noted by Jan Kara in 20181; however, more recently...