120 matches found
Grok-backdoor
Grok-backdoor Grok-backdoor는 Python 기반의 간단한 백도어로, C&C 통신에 Ngrok 터널을 사용합니다. Ngrok-backdoor는 Pyinstaller를 사용하여 Windows, Linux 및 Mac 바이너리를 생성할 수 있습니다. 작동 방식: Ngrok는 NAT 및 방화벽 뒤에 있는 로컬 서버를 보안 터널을 통해 공용 인터넷에 노출합니다. Ngrok는 고유한 포트 번호를 통해 맬웨어 로컬 리스너 포트와 ngrok 서버 공용 IP 간의 터널을 설정합니다. 공격자는 Ngrok 공용 IP와 고유 포...
PythonAESObfuscate
PythonAESObfuscate Python 방식으로 쉘코드를 로드합니다. EXE도 생성해줍니다! 사용법 payload.bin 원시 쉘코드 파일을 동일한 디렉토리에 배치합니다. 기본 아키텍처는 x86입니다 python obfuscate.py 실행 기본 출력 파일은 out.py입니다 요구 사항 Windows Python 2.7 Pyinstaller PyCrypto PyCryptodome은 작동하지 않는 것으로 보입니다...
pytmipe
PYTMIPE & TMIPE PYTMIPE PYthon library for Token Manipulation and Impersonation for Privilege Escalation is a Python 3 library for manipulating Windows tokens and managing impersonations in order to gain more privileges on Windows. TMIPE is the python 3 client which uses the pytmipe library...
PyInstallerPrivEsc
PyInstallerPrivEsc PyInstaller CVE-2019-16784용 익스플로잇 기사 곧 게시 예정...
Ares
Ares Ares는 Python 원격 접속 도구입니다. 경고: 이 소프트웨어는 현재 귀하의 법률에 따라서만 사용하십시오. 이 소프트웨어의 오용은 법적 및 윤리적 문제를 야기할 수 있으며, 이에 대해 저는 지지하지 않으며 책임을 지지 않습니다. Ares는 두 가지 주요 프로그램으로 구성됩니다: CNCCommand and Control 서버: 에이전트를 관리하는 웹 인터페이스 에이전트 프로그램: 공격받은 호스트에서 실행되며 CNC와 통신을 유지합니다 웹 인터페이스는 Python이 실행되는 모든 서버에서 실행할 수 있습니다. 에이전...
meterssh
Tool Name: MeterSSH Written by: David Kennedy Company: TrustedSec Website: https://www.trustedsec.com Twitter: @TrustedSec, @HackingDave MeterSSH is a way to take shellcode, inject it into memory then tunnel whatever port you want to over SSH to mask any type of communications as a normal SSH...
CVE-2019-16784-POC
CVE-2019-16784 POC Dies ist mein POC für die Windows PyInstaller Version 3.6 Schwachstelle, die für die --onefile-Option existiert. Ein Angreifer könnte Codeausführung und möglicherweise LPE erreichen, indem er eine DLL kapert, die von der von der PyInstaller-Binärdatei verwendeten...
MAL-2026-10756 Malicious code in darkglitch (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a84fec55fc625d5e2b337aafe5a9a95ff30c47403241c59dbb33543ec97311a The package installs a listener CLI darkglitch -l -b that opens a WebSocket to the hardcoded signaling host malware-signal.vercel.app and joins the...
PYSEC-2026-1813 PyInstaller has local privilege escalation vulnerability
Impact Due to a special entry being appended to sys.path during the bootstrap process of a PyInstaller-frozen application, and due to the bootstrap script attempting to load an optional module for bytecode decryption while this entry is still present in sys.path, an application built with...
Hackers Use PyInstaller and AMSI Patching to Deliver XWorm RAT v7.4
Hackers are hiding XWorm malware in PyInstaller files to bypass Windows security, steal data and remotely control devices through ads...
Malicious code in polyutil (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 31a0fc68eee0841a78740fd3e3748171612b871b58bf9f3e52b4fa35bed64774 The package is prepared to download a hardcoded executable and save it in %LOCALAPPDATA% under a very generic name, clearly aiming to hide its existence. Code ...
MAL-2026-927 Malicious code in polyclawd (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 1f994af0e1b17c0d30e950a5aef9a45d8e34f6f59ab45fadddb05b340ed5cdad The package is prepared to download a hardcoded executable and save it in %LOCALAPPDATA% under a very generic name, clearly aiming to hide its existence. Code ...
Malicious code in polyclawd (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 1f994af0e1b17c0d30e950a5aef9a45d8e34f6f59ab45fadddb05b340ed5cdad The package is prepared to download a hardcoded executable and save it in %LOCALAPPDATA% under a very generic name, clearly aiming to hide its existence. Code ...
Malicious code in clawdist (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 3008887b6c2929530cd48dc996c91d70eb92432465d02f4ff28e6d5927350097 The package is prepared to download a hardcoded executable and save it in %LOCALAPPDATA% under a very generic name, clearly aiming to hide its existence. Code ...
CVE-2019-16784
In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is present in this particular case: If a software using PyInstaller in "onefile" mode is launched by a privileged user at least more than the current one which have his "TempPath" resolving to a world...
New VVS Stealer Malware Targets Discord Accounts via Obfuscated Python Code
Cybersecurity researchers have disclosed details of a new Python-based information stealer called VVS Stealer also styled as VVS $tealer that's capable of harvesting Discord credentials and tokens. The stealer is said to have been on sale on Telegram as far back as April 2025, according to a repo...
10 npm Packages Caught Stealing Developer Credentials on Windows, macOS, and Linux
Cybersecurity researchers have discovered a set of 10 malicious npm packages that are designed to deliver an information stealer targeting Windows, Linux, and macOS systems. "The malware uses four layers of obfuscation to hide its payload, displays a fake CAPTCHA to appear legitimate, fingerprint...
Privilege Escalation
PyInstaller is vulnerable to Privilege Escalation. The vulnerability is due to the bootstrap process appending a special entry to sys.path and attempting to load an optional bytecode-decryption module while that entry is present, which allows an attacker who can create files/directories next to t...
