Hunt-Weird-ImageLoads

Hunt-Weird-ImageLoads This project was created to play with different IOCs caused by Imageload events. It leverages ETW to monitor for ImageLoad events and walks the callstack to identify some possible IOCs, such as: RWX page in callstack Stomped module in callstack Module proxying ntdll -...

ExportDumper

ExportDumper A small tool I made to dump the export table of PE files. The primary use case was intended for use within DLL proxying. Usage .\ExportDump dllpath e.g. .\ExportDump C:\Windows\System32\version.dll Dumping all 17 exported functions from C:\windows\system32\version.dll. + Dumping done...

DLLirant

DLLirant DLLirant is a tool to automatize the DLL Hijacking and DLL Proxying researches on a specified binary. Final PoC output when a DLL Hijacking is found: Old Live Demo similar to the new version How to install Install LLVM for Windows x64 LLVM-version-win64.exe:...

TeamsImplant

TeamsImplant This project is a stealthy teams implant that proxies the urlmon.dll that teams uses compile and throw this bad boy in the teams directory as urlmon.dll and you got yourself a persistence backdoor whenever teams runs by a user or at startup. Features: Mutex so you don't get spammed...

HashSiphon

HashSiphon NTLM hash extraction through HTTP-layer authentication proxying, zero SSPI calls from the attacker process. HashSiphon extracts the current user's NetNTLMv2 hash by manipulating HTTP authentication flows instead of calling SSPI APIs directly. It ships two variants: v1 routes NTLM auth...

DLHell

DLHell DLHell performs DCOM local & remote Windows DLL Proxying. Install The following packages are required might depend on your distro, the following example is for Debian 12: sudo apt install -y g++-mingw-w64-x86-64-win32 binutils-mingw-w64-x86-64 Install pip dependencies: pip3 install -r...

CVE-2024-30090

CVE-2024-30090 - LPE PoC CVE-2024-30090 found by Angelboy with DEVCORE. Parent.cpp Get the ntoskrnl base by using NtQuerySystemInformation medium-integrity - Compile as x64. Child.cpp The exploit for CVE-2024-30090 - Compile as x86. Thanks Big thanks Angelboy for your help and guidance!. Cedric...

CVE-2024-22774

Panoramic Dental Imaging Software 9.1.2.7600. Phantom DLL Hijack Privilege Escalation CVE-2024-22774 Table of Contents Table of Contents Introduction Final Version of the Software Searching for Hijackable DLL Setting up the attack Exploit Persistance after OS install Introduction Originally, this...

CVE-2024-58394

Retool versions before 3.88.0 are vulnerable to a cross-site scripting (XSS) flaw. An unauthenticated attacker can execute scripts in a victim's session by proxying a malicious SVG file through the /api/imageProxy endpoint. The vulnerability exists because the application serves the SVG from the ...

DataInject-BOF

Data Inject BOF A beacon object file implementation of the process injection proof-of-concept from my blog post Control Flow Hijacking via Data Pointers. Hijacks control flow via overwriting combase.dll's Control Flow Guard function pointers called by COM proxying functions. Important Notes From ...

LibTP_Gadget

LibTPGadget This is a generalisation of https://github.com/AlmondOffSec/LibTPLoadLib to proxy APIs with an arbitrary number 11 max actually, but good enough of arguments. Provided as a Crystal Palace shared library. API made compatible with @rasta-mouse's LibTP for easy switch using spec files...

refresh

Refresh This container emulates the vulnerable functionality of CVE-2022-1388 in an F5 Router allowing RCE. CVE-202201388 stems from a complicated relationship between different authentication mechanisms and broxying that stripped Headers allowing improper access to admin endpoints in the webapp...

gluegate

gluegate Detection research PoC: proxy memory operations memory mapping, local memory allocation through Mozilla's signedmozglue.dll so kernel callbacks attribute the final user module to a trusted vendor DLL Mozilla signed instead of untrusted or unsigned module. Proxied APIs Both are MFBTAPI...

Astra Linux – Vulnerability in xrdp

xrdp is an open-source RDP server. Versions up to 0.10.5 contain a heap-based buffer overflow vulnerability in the NeutrinoRDP module. When proxying RDP sessions from xrdp to another server, the module fails to properly validate the size of reassembled fragmented virtual channel data against its...

EUVD-2026-91837

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

EUVD-2026-60085

SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint /ws/network/proxy via explicit CheckOrigin: true bypass...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...