ropr

ropr ropr は、超高速のマルチスレッド ROP ガジェット検出器です。 ROP ガジェットとは？ ROP Return Oriented Programming ガジェットは、通常 ret 命令で終わる数個のアセンブリ命令の小さな断片であり、各バイナリやライブラリ内に実行可能コードとして既に存在します。これらのガジェットは、バイナリエクスプロイトや脆弱な実行ファイルの乗っ取りに使用される可能性があります。 多くの ROP ガジェットのアドレスがバッファに書き込まれると、ROP チェーンが形成されます。攻撃者がスタックポインタをこの ROP...

CVE-2019-11932

CVE-2019-11932 La dirección de system y el gadget deben reemplazarse por la dirección real encontrada mediante una vulnerabilidad de divulgación de información. Después de reemplazar la dirección de system y el gadget, ejecute el código para generar el archivo GIF corrupto: root@kitploit:...

rp

rp++: PE/ELF/Mach-O x86/x64/ARM/ARM64 バイナリ向けの高速 ROP ガジェットファインダー 概要 rp++ または rp は、PE/ELF/Mach-O 実行ファイルおよび x86/x64/ARM/ARM64 アーキテクチャ向けの C++ 製 ROP ガジェットファインダーです。 ROP ガジェットの検出 ROP ガジェットを検出するには、--file / -f オプションでファイルを指定し、--rop / -r オプションでガジェット内の最大命令数を指定します:...

effective-waffle

effective-waffle otra cosa de cifrado de sleep. también usé el nombre de repositorio predeterminado de GitHub para este. TpAllocWork + TpPostWork + TpWaitForWork + TpReleaseWork para crear + ejecutar + limpiar el callback. El callback es un ensamblado chapucero que pone en cola un montón de gadge...

bfdecrypt

bfdecrypt 用于解密越狱 iOS 11.x 上 App Store 应用的工具 在 LiberiOS 上解密 App Store 应用 以下是使用 https://github.com/BishopFox/bfinject 在 Electra 越狱 iPhone 上解密 Reddit 应用的示例： root@kitploit: Cs-iPhone: root bash bfinject -P Reddit -l dylibs/bfdecrypt.dylib + Electra detected. + Injecting into...

CVE-2019-11932-SupportApp

CVE-2019-11932-SupportApp 此原生代码文件旨在作为 Awakened 所发布的 WhatsApp GIF RCE 漏洞利用的补充，通过计算不同设备类型的 system 函数地址和 ROP 小工具地址，从而能够成功利用该漏洞。...

nullsec-exploit

💀 NullSec Exploit Advanced Exploit Development & Payload...

Exploit for Code Injection in Citrix Netscaler_Application_Delivery_Controller

Citrix ADC RCE CVE-2023-3519 This exploit uses addresses and s...

Exploit for Code Injection in Citrix Netscaler_Application_Delivery_Controller

Citrix ADC RCE CVE-2023-3519 This exploit uses addresses and s...

Ropr - A Blazing Fast Multithreaded ROP Gadget Finder. Ropper / Ropgadget Alternative

ropr is a blazing fast multithreaded ROP Gadget finder What is a ROP Gadget? ROP Return Oriented Programming Gadgets are small snippets of a few assembly instructions typically ending in a ret instruction which already exist as executable code within each binary or library. These gadgets may be...

CVE-2021-1099

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager vGPU plugin that could allow an attacker to cause stack-based buffer overflow and put a customized ROP gadget on the stack. Such an attack may lead to information disclosure, data tampering, or denial of service. This affect...

CVE-2021-1099

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager vGPU plugin that could allow an attacker to cause stack-based buffer overflow and put a customized ROP gadget on the stack. Such an attack may lead to information disclosure, data tampering, or denial of service. This affect...

Stack overflow

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager vGPU plugin that could allow an attacker to cause stack-based buffer overflow and put a customized ROP gadget on the stack. Such an attack may lead to information disclosure, data tampering, or denial of service. This affect...

CVE-2021-1099

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager vGPU plugin that could allow an attacker to cause stack-based buffer overflow and put a customized ROP gadget on the stack. Such an attack may lead to information disclosure, data tampering, or denial of service. This affect...

WriteUp_GoogleCTF_2017

This is a PoC exploit for a vulnerability in the Inst Prof binary, which is a x8664 Linux binary with PIE and NX enabled. The exploit allocates two pages using code reuse, one page to stack pivot and the other page to execute a shellcode. The shellcode is executed by dereferencing a text pointer...

Whatsapp 2.19.216 - Remote Code Execution Exploit

Exploit Title: Whatsapp 2.19.216 - Remote Code Execution Exploit Author: Valerio Brussani @valbrux Vendor Homepage: https://www.whatsapp.com/ Version: include include include typedef uint8t byte; char gadgetp; void libc, lib; //dls iteration for rop int dlcallbackstruct dlphdrinfo info, sizet siz...

Whatsapp 2.19.216 Remote Code Execution

Exploit Title: Whatsapp 2.19.216 - Remote Code Execution Date: 2019-10-16 Exploit Author: Valerio Brussani @valbrux Vendor Homepage: https://www.whatsapp.com/ Version: include include include typedef uint8t byte; char gadgetp; void libc, lib; //dls iteration for rop int dlcallbackstruct dlphdrinf...

Whatsapp 2.19.216 - Remote Code Execution

Exploit Title: Whatsapp 2.19.216 - Remote Code Execution Date: 2019-10-16 Exploit Author: Valerio Brussani @valbrux Vendor Homepage: https://www.whatsapp.com/ Version: include include include typedef uint8t byte; char gadgetp; void libc, lib; //dls iteration for rop int dlcallbackstruct dlphdrinf...

In-depth analysis of the thread and process handle leak vulnerability, under-vulnerability warning-the black bar safety net

PROCESSVM It covers the VM access permissions three types: WRITE/READ/OPERATION. The first two permissions should be self-explanatory, the third permission allows the operation of the virtual address space itself, such as modifying the page protection VirtualProtectEx or allocating memory with...

Netperf 2.6.0 Buffer Overflow

Exploit Author: Juan Sacco - http://exploitpack.com Tested on: Kali i686 GNU/Linux Description: Netperf 2.6.0 s a benchmark tool than developed by Hewlett Packard that can be used to measure the performance of many different types of networking. It provides tests for both unidirectional troughput...