shed

Shed - .NET runtime inspector Shed is an application that allow to inspect the .NET runtime of a program in order to extract useful information. It can be used to inspect malicious applications in order to have a first general overview of which information are stored once that the malware is...

injectAmsiBypass

Cobalt Strike BOF - 注入AMSI绕过 Cobalt Strike Beacon对象文件BOF，通过代码注入绕过远程进程中的AMSI。 从CobaltStrike运行inject-amsiBypass BOF 它的作用是什么？ 1. 使用提供的PID参数获取远程进程的句柄 hProc = KERNEL32$OpenProcessPROCESSVMOPERATION | PROCESSVMWRITE, FALSE, DWORDpid; 2. 将AMSI.DLL加载到Beacon的内存中，并获取AMSI.AmsiOpenSession的地址 hProc =...

Split

Descripción Divide and Conquer es un algoritmo que se aplica comúnmente en programación para resolver un problema complejo dividiéndolo en muchos subproblemas más simples. Podemos aplicar este enfoque a la seguridad ofensiva con un objetivo diferente: confundir a los EDR para que pierdan el rastr...

inject-assembly

inject-assembly - Execute .NET in an Existing Process This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon,...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via improper sanitization of .. in the Remote process. An attacker can manipulate file paths to escape the intended backend confinement by supplying specially crafted object names containing directory traversal...

CVE-2026-85451 MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphrase

MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process...

CVE-2026-85451

MOOS core-moos through 10.4.0 is affected by a remote process termination vulnerability in the SuicidalSleeper component. The root cause is a hard-coded passphrase used for multicast command authorization, allowing any multicast-reachable peer to enumerate MOOS processes and send termination comm...

CVE-2026-85451 MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphrase

MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process...

HTTP Response Splitting

Overview Affected versions of this package are vulnerable to HTTP Response Splitting via the headers option in the Remote process. An attacker can inject or override HTTP headers in outgoing requests by including newline characters in user-controlled input that is forwarded to the header value...

MBS多款产品 输入验证错误漏洞

MBS Single-A and other products are a series of industrial communication gateways developed by the German company MBS. Several MBS products have a vulnerability related to input validation errors. This vulnerability stems from the insufficient input validation provided by the ugw-logstop method,...

Apache HTTP Server 代码问题漏洞

Apache HTTP Server is an open-source web server developed by the Apache Foundation in the United States. This server is known for its speed, reliability, and ability to be expanded through simple APIs. Versions of Apache HTTP Server 2.4.66 and earlier have code vulnerabilities related to null...

EUVD-2019-20058

Remote Process Explorer 1.0.0.16 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by sending a crafted payload to the Add Computer dialog. Attackers can paste a malicious string into the computer name textbox and trigger a crash by connecting to th...

CVE-2019-25661

Remote Process Explorer 1.0.0.16 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by sending a crafted payload to the Add Computer dialog. Attackers can paste a malicious string into the computer name textbox and trigger a crash by connecting to th...

CVE-2019-25661

Remote Process Explorer 1.0.0.16 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by sending a crafted payload to the Add Computer dialog. Attackers can paste a malicious string into the computer name textbox and trigger a crash by connecting to th...

CVE-2019-25661 Remote Process Explorer 1.0.0.16 Local Buffer Overflow DoS

Remote Process Explorer 1.0.0.16 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by sending a crafted payload to the Add Computer dialog. Attackers can paste a malicious string into the computer name textbox and trigger a crash by connecting to th...

CVE-2019-25661 Remote Process Explorer 1.0.0.16 Local Buffer Overflow DoS

Remote Process Explorer 1.0.0.16 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by sending a crafted payload to the Add Computer dialog. Attackers can paste a malicious string into the computer name textbox and trigger a crash by connecting to th...

CVE-2019-25661

Remote Process Explorer 1.0.0.16 is affected by a local buffer overflow in the Add Computer dialog. A crafted string pasted into the computer name textbox can crash the added computer by overwriting the SEH chain, causing denial of service. The issue is local, with low attack complexity and no pr...

PT-2026-30470

Remote Process Explorer 1.0.0.16 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by sending a crafted payload to the Add Computer dialog. Attackers can paste a malicious string into the computer name textbox and trigger a crash by connecting to th...

LizardSystems Remote Process Explorer 缓冲区错误漏洞

LizardSystems Remote Process Explorer is a remote process management tool developed by LizardSystems. Version 1.0.0.16 of Remote Process Explorer contains a buffer overflow vulnerability. This vulnerability stems from a local buffer overflow in the “Add Computer” dialog box, which could allow...

CVE-2019-25661: Out-of-bounds Write

Remote Process Explorer 1.0.0.16 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by sending a crafted payload to the Add Computer dialog. Attackers can paste a malicious string into the computer name textbox and trigger a crash by connecting to th...