gluegate

gluegate Detection research PoC: proxy memory operations memory mapping, local memory allocation through Mozilla's signedmozglue.dll so kernel callbacks attribute the final user module to a trusted vendor DLL Mozilla signed instead of untrusted or unsigned module. Proxied APIs Both are MFBTAPI...

EUVD-2026-91837

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

EUVD-2026-60085

SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint /ws/network/proxy via explicit CheckOrigin: true bypass...

Hunt-Weird-ImageLoads

Hunt-Weird-ImageLoads This project was created to play with different IOCs caused by Imageload events. It leverages ETW to monitor for ImageLoad events and walks the callstack to identify some possible IOCs, such as: RWX page in callstack Stomped module in callstack Module proxying ntdll -...

LibTP_Gadget

LibTPGadget This is a generalisation of https://github.com/AlmondOffSec/LibTPLoadLib to proxy APIs with an arbitrary number 11 max actually, but good enough of arguments. Provided as a Crystal Palace shared library. API made compatible with @rasta-mouse's LibTP for easy switch using spec files...

CVE-2024-22774

Panoramic Dental Imaging Software 9.1.2.7600. Phantom DLL Hijack Privilege Escalation CVE-2024-22774 Table of Contents Table of Contents Introduction Final Version of the Software Searching for Hijackable DLL Setting up the attack Exploit Persistance after OS install Introduction Originally, this...

DLLirant

DLLirant DLLirant is a tool to automatize the DLL Hijacking and DLL Proxying researches on a specified binary. Final PoC output when a DLL Hijacking is found: Old Live Demo similar to the new version How to install Install LLVM for Windows x64 LLVM-version-win64.exe:...

TeamsImplant

TeamsImplant This project is a stealthy teams implant that proxies the urlmon.dll that teams uses compile and throw this bad boy in the teams directory as urlmon.dll and you got yourself a persistence backdoor whenever teams runs by a user or at startup. Features: Mutex so you don't get spammed...

DataInject-BOF

Data Inject BOF A beacon object file implementation of the process injection proof-of-concept from my blog post Control Flow Hijacking via Data Pointers. Hijacks control flow via overwriting combase.dll's Control Flow Guard function pointers called by COM proxying functions. Important Notes From ...

DLHell

DLHell DLHell は、Windows のローカルおよびリモートでの DCOM DLL プロキシングを実行します。 インストール 以下のパッケージが必要です（ディストリビューションによって異なる場合があります。次の例は Debian 12 用です）。 sudo apt install -y g++-mingw-w64-x86-64-win32 binutils-mingw-w64-x86-64 pip 依存関係をインストール: pip3 install -r requirements.txt クイックスタート 次のコマンドは、ホスト 10.137.0.48 上の...

CVE-2024-30090

CVE-2024-30090 - LPE PoC CVE-2024-30090 found by Angelboy with DEVCORE. Parent.cpp Get the ntoskrnl base by using NtQuerySystemInformation medium-integrity - Compile as x64. Child.cpp The exploit for CVE-2024-30090 - Compile as x86. Thanks Big thanks Angelboy for your help and guidance!. Cedric...

CentOS Linux 8.5 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS8.5:CLSA-2026:1782979036)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1782979036 advisory. - A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker...

AlmaLinux 9.6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.6:CLSA-2026:1773312266)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1773312266 advisory. - A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker...

CentOS Linux 8.4 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS8.4:CLSA-2026:1782979343)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1782979343 advisory. - A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker...

refresh

Refresh This container emulates the vulnerable functionality of CVE-2022-1388 in an F5 Router allowing RCE. CVE-202201388 stems from a complicated relationship between different authentication mechanisms and broxying that stripped Headers allowing improper access to admin endpoints in the webapp...

HashSiphon

HashSiphon 通过 HTTP 层身份验证代理提取 NTLM 哈希，攻击者进程零 SSPI 调用。 HashSiphon 通过操纵 HTTP 身份验证流程而非直接调用 SSPI API 来提取当前用户的 NetNTLMv2 哈希。它提供两个变体：v1 在同一进程内通过 .NET 的 HTTP 栈路由 NTLM 身份验证，v2 将身份验证完全委托给不同 PID 中的 BITS 服务（svchost.exe），从而彻底打破进程级归因。 为什么这很重要 所有已知的 NTLM 哈希自提取工具 Internal Monologue、手动 SSPI 脚本及其衍生工具都会从攻击者自己的进程调用...

ExportDumper

ExportDumper A small tool I made to dump the export table of PE files. The primary use case was intended for use within DLL proxying. Usage .\ExportDump dllpath e.g. .\ExportDump C:\Windows\System32\version.dll Dumping all 17 exported functions from C:\windows\system32\version.dll. + Dumping done...

Astra Linux – Vulnerability in xrdp

xrdp is an open-source RDP server. Versions up to 0.10.5 contain a heap-based buffer overflow vulnerability in the NeutrinoRDP module. When proxying RDP sessions from xrdp to another server, the module fails to properly validate the size of reassembled fragmented virtual channel data against its...

USN-8571-2: Apache HTTP Server regression

USN-8571-1 fixed vulnerabilities in Apache HTTP Server. That fix was incomplete due to a missing library symbol, resulting in a regression that could cause Apache HTTP Server to fail to start when HTTP/2 proxying was enabled. This update fixes the problem. We apologize for the inconvenience...

CVE-2026-77348: Unintended Proxy or Intermediary

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable" hardened endpoints/logos/search.php by disabling cURL proxying CURLOPTPROXY = '' + CURLOPTNOPROXY = ''. However...