TeamsImplant

TeamsImplant This project is a stealthy teams implant that proxies the urlmon.dll that teams uses compile and throw this bad boy in the teams directory as urlmon.dll and you got yourself a persistence backdoor whenever teams runs by a user or at startup. Features: Mutex so you don't get spammed...

gluegate

gluegate 検出研究用PoC: Mozillaの署名付きmozglue.dll を介してメモリ操作（メモリマッピング、ローカルメモリ割り当て）をプロキシすることで、カーネルコールバックが最終ユーザーモジュールを、信頼されていないモジュールや署名なしモジュールではなく、信頼されたベンダーDLL（Mozilla署名）に帰属させます。 プロキシされる API 両方とも mozglue.dll の MFBTAPI エクスポート です（Firefoxのインストールが必要）。 Mode| Export| Mozilla source ---|---|--- inject|...

CVE-2024-22774

Панорамное стоматологическое программное обеспечение для визуализации 9.1.2.7600. Повышение привилегий через внедрение Phantom DLL CVE-2024-22774 Содержание Содержание Введение Финальная версия программного обеспечения Поиск перехватываемой DLL Настройка атаки Эксплойт Постоянство после установки...

refresh

Refresh 이 컨테이너는 RCE원격 코드 실행를 허용하는 F5 라우터의 CVE-2022-1388 취약 기능을 에뮬레이션합니다. CVE-202201388은 서로 다른 인증 메커니즘과 헤더를 제거하는 프록시 처리 간의 복잡한 관계로 인해 발생하며, 웹앱에서 관리자 엔드포인트에 대한 부적절한 접근을 허용합니다. 참가자는 자신의 봇을 사용하여 이 결함을 악용하는 웹 요청을 보내야 합니다. 빌드 root@kitploit: docker build -t refresh . 실행 root@kitploit: docker run -p 80:8...

LibTP_Gadget

LibTPGadget 이것은 https://github.com/AlmondOffSec/LibTPLoadLib 을 일반화한 것으로, 임의 개수실제로는 최대 11개이지만 충분히 쓸 만한의 인자를 가진 API를 프록시하기 위한 것입니다. Crystal Palace 공유 라이브러리로 제공됩니다. API는 @rasta-mouse의 LibTP와 호환되도록 만들어져 spec 파일을 통해 쉽게 전환할 수 있습니다. 최신 Crystal Palace 기능을 선보이기 위한 후크가 제공됩니다. 경고 ⚠️ : 이 프로젝트는 그대로 사용할 수 없습니다...

Hunt-Weird-ImageLoads

Hunt-Weird-ImageLoads This project was created to play with different IOCs caused by ImageLoad events. It leverages ETW to monitor for ImageLoad events and walks the callstack to identify some possible IOCs, such as: RWX page in callstack Stomped module in callstack Module proxying ntdll -...

DLLirant

DLLirant DLLirant는 지정된 바이너리에 대한 DLL 하이재킹DLL Hijacking 및 DLL 프록시DLL Proxying 연구를 자동화하는 도구입니다. DLL 하이재킹이 발견되었을 때 최종 PoC 출력: 이전 라이브 데모 신규 버전과 유사 설치 방법 Windows x64용 LLVM 설치 LLVM-version-win64.exe: https://github.com/llvm/llvm-project/releases 설치 중 "Add LLVM to the system PATH for current user" 옵션을 체크...

DataInject-BOF

Data Inject BOF 제 블로그 게시물 Control Flow Hijacking via Data Pointers의 프로세스 인젝션 개념 증명PoC을 BOFBeacon Object File로 구현한 것입니다. COM 프록시 함수가 호출하는 combase.dll의 Control Flow Guard 함수 포인터를 덮어써 제어 흐름을 가로챕니다. 중요 참고 사항 제 테스트 결과, explorer.exe는 COM 프록시에 크게 의존하기 때문에 트리거가 쉬운 현재 최적의 후보입니다. 직접 실험해 보시길 권장합니다. 이 BOF는...

DLHell

DLHell DLHell은 DCOM 로컬 및 원격 Windows DLL 프록시를 수행합니다. 설치 다음 패키지가 필요합니다배포판에 따라 다를 수 있으며, 다음 예시는 Debian 12 기준입니다: root@kitploit: sudo apt install -y g++-mingw-w64-x86-64-win32 binutils-mingw-w64-x86-64 pip 종속성을 설치합니다: root@kitploit: pip3 install -r requirements.txt 빠른 시작 다음 명령은 calc.exe를 실행하는...

USN-8571-2: Apache HTTP Server regression

USN-8571-1 fixed vulnerabilities in Apache HTTP Server. That fix was incomplete due to a missing library symbol, resulting in a regression that could cause Apache HTTP Server to fail to start when HTTP/2 proxying was enabled. This update fixes the problem. We apologize for the inconvenience...

CVE-2024-30090

CVE-2024-30090 - LPE PoC CVE-2024-30090 は Angelboy と DEVCORE によって発見されました。 Parent.cpp NtQuerySystemInformation medium-integrity を使用して ntoskrnl ベースを取得 - x64 としてコンパイル Child.cpp CVE-2024-30090 のエクスプロイト - x86 としてコンパイル 謝辞 多大な 感謝を Angelboy に、あなたの助けと指導に感謝します！ Cedric Halbronn 'OST2 - Exploitation 4011 -...

ExportDumper

ExportDumper PE 파일의 익스포트 테이블을 덤프하기 위해 만든 작은 도구입니다. 주된 사용 용도는 DLL 프록시DLL proxying 내에서 사용하기 위한 것이었습니다. 사용법 root@kitploit: .\ExportDump dllpath 예: root@kitploit: .\ExportDump C:\Windows\System32\version.dll Dumping all 17 exported functions from C:\windows\system32\version.dll. + Dumping done. Check...

EUVD-2026-60085

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket...

[SECURITY] Fedora 44 Update: trafficserver-10.1.4-1.fc44

Traffic Server is a high-performance building block for cloud services. It's more than just a caching proxy server; it also has support for plugins to build large scale web applications. Key features: Caching - Improve your response time, while reducing server load and bandwidth needs by caching...

CVE-2026-17552 Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call

Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUESTURI concatenation in call. When the rewrite base is a plain string, the REQUESTURI is appended to it, with no check that the path starts with a forward slash '/'. When the rewrite base does...

UBUNTU-CVE-2026-6790

In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present. This was not enforced in earlier HTTP RFC for example, in RFC 2616, but it is in the latest RFC 9110 and 9112. This...

CVE-2026-6790

In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present. This was not enforced in earlier HTTP RFC for example, in RFC 2616, but it is in the latest RFC 9110 and 9112. This...

PYSEC-2026-1420 gradio Server-Side Request Forgery vulnerability

An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the /proxy route. Attackers can exploit this vulnerability by manipulating the self.replicaurls set through the X-Direct-Url header in requests to the / and /config routes, allowing the...

PT-2026-53923

Name of the Vulnerable Software and Affected Versions Ocelot versions prior to 24.1.1 Description A security control bypass exists in the handling of WebSocket upgrade requests. The issue stems from a logic flaw in the OcelotPipelineExtensions.cs file, where a MapWhen branch configured for...

CVE-2026-53931

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-import endpoint axiosRequestMake could be used as a generic HTTP proxy. Before the fix it was reachable unauthenticated, and its URL-extension allowlist was a regex tested against the full URL string, s...