peda

peda PEDA - Python Exploit Development Assistance for GDB Key Features: Enhance the display of gdb: colorize and display disassembly codes, registers, memory information during debugging. Add commands to support debugging and exploit development for a full list of commands use peda help: aslr --...

barf-project

BARF : 二进制分析与逆向工程框架 二进制代码分析是计算机科学和软件工程许多领域中的关键活动，涵盖软件安全、程序分析到逆向工程。手动二进制分析是一项困难且耗时的任务，存在一些旨在自动化或协助人类分析师的软件工具。然而，大多数这些工具具有若干技术和商业限制，限制了学术界和从业者社区大部分人的访问和使用。 BARF...

crauEmu

吉祥物由@kottsarapkin 设计 crauEmu 是一个 uEmu 扩展，用于开发和分析代码重用攻击的载荷。 ZeroNights 2019 幻灯片 演示1 - X32-64, Edge, 来自 pwnjs 的 ROP 小工具 演示2 - ARM64, checkm8 回调链 RopEditor 安装 1. 将文件 crauEmu.py 放置在与 uEmu.py 相同的位置。 2. 在 IDA 中使用 File / Script file... 或 ALT+F7 加载 crauEmu.py 。...

elfxtract

ELFXtract ELFXtract 是一款自动化分析工具，用于枚举 ELF 二进制文件 由 Radare2 和 r2ghidra 提供支持 该工具专门为 PWN 挑战开发，具有许多自动化功能 它几乎显示 ELF 的所有详细信息，并使用 r2ghidra 将其 ASM 反编译为 C 代码 在 Ghidra 中反编译 ELF 需要更多时间，但在 elfxtract 中，反编译和显示只需几秒 ELFXtract 的功能 1. 文件信息 2. 共享对象依赖详细信息 3. ELF 安全缓解措施详细信息 / Checksec 4. 字符串详细信息 5. 头部内存映射 6. ROP 小工具 7...

Chakra-CVE-2019-0567

Chakra-CVE-2019-0567 Una PoC de un bug de confusión de tipos en el framework chakracore que conduce a ejecución de código. Del blog de Connor McGar https://connormcgarr.github.io/ NOTA: Los offsets y los gadgets ROP dependen de la versión de Windows que uses, por lo que podría no funcionar para t...

CVE-2019-11932-SupportApp

CVE-2019-11932-SupportApp Este archivo de código nativo pretende ser complementario al exploit de RCE de WhatsApp GIF publicado por Awakened, mediante el cálculo de la dirección de la función system y la dirección del gadget ROP para diferentes tipos de dispositivos, que luego pueden usarse para...

cve-2019-1663

🚀 Explotación de CVE-2019-1663 🧩 Introducción Este repositorio documenta la explotación de CVE-2019-1663, una vulnerabilidad crítica de ejecución remota de código RCE que afecta a los routers VPN Wireless-N Cisco RV110W, RV130W y RV215W. Debido a una validación de entrada insuficiente en la...

obliteratus-brain

OBLITERATUS BRAIN The Persistent Knowledge Layer for OBLITE...

CVE-2018-25221

EChat Server 3.1 contains a buffer overflow vulnerability in the chat.ghp endpoint that allows remote attackers to execute arbitrary code by supplying an oversized username parameter. Attackers can send a GET request to chat.ghp with a malicious username value containing shellcode and ROP gadgets...

CVE-2018-25224

PMS 0.42 contains a stack-based buffer overflow vulnerability that allows local unauthenticated attackers to execute arbitrary code by supplying malicious values in the configuration file. Attackers can craft configuration files with oversized input that overflows the stack buffer and execute she...

CVE-2018-25221

EChat Server 3.1 contains a buffer overflow vulnerability in the chat.ghp endpoint that allows remote attackers to execute arbitrary code by supplying an oversized username parameter. Attackers can send a GET request to chat.ghp with a malicious username value containing shellcode and ROP gadgets...

CVE-2018-25221

Affected product: EChat Server 3.1. Vulnerability: Buffer overflow in the chat.ghp endpoint, exploitable by sending a GET request with an oversized username value, leading to remote code execution in the application context. The provided description states that shellcode and ROP gadgets can be us...

CVE-2018-25217 PDF Explorer 1.5.66.2 Structured Exception Handler Local Code Execution

PDF Explorer 1.5.66.2 contains a structured exception handler SEH overflow vulnerability that allows local attackers to execute arbitrary code by overwriting SEH records with malicious data. Attackers can craft a payload with buffer overflow, NSEH jump, and ROP gadget chains that execute when the...

Bropper - An Automatic Blind ROP Exploitation Tool

An automatic Blind ROP exploitation python tool Abstract BROP Blind ROP was a technique found by Andrew Bittau from Stanford in 2014. Original paper Slides Most servers like nginx, Apache, MySQL, forks then communicates with the client. This means canary and addresses stay the same even if there ...

ELFXtract - An Automated Analysis Tool Used For Enumerating ELF Binaries

ELFXtract is an automated analysis tool used for enumerating ELF binaries Powered by Radare2 and r2ghidra This is specially developed for PWN challenges and it has many automated features It almost displays every details of the ELF and also decompiles its ASM to C code using r2ghidra Decompiling...

Four More Bugs Patched in Microsoft’s Azure Sphere IoT Platform

Details tied to a pair of remote code execution bugs in Microsoft’s IoT security platform called Azure Sphere were released Monday. Also made public were specifics associated with two additional privilege escalation flaws impacting the same cloud security platform. Public disclosure of all four o...

Valve: OOB reads in network message handlers leads to RCE

Vulnerability In Source engine games there are many network messages sent from the server to the client that take an entity index. There is a common pattern among many of these messages for the lower bounds of the entity index to be checked but not the upper bounds. In many cases these out of bou...

MikroTik RouterOS 6.38.4 (x86) - Chimay Red Stack Clash Remote Code Execution

MikroTik RouterOS 6.38.4 x86 - Chimay Red Stack Clash Remote Code Execution !/usr/bin/env python2 Mikrotik Chimay Red Stack Clash Exploit by wsxarcher based on BigNerd95 POC tested on RouterOS 6.38.4 x86 ASLR enabled on libs only DEP enabled import socket, time, sys, struct from pwn import import...

PHP 5.5.33 / 7.0.4 - SNMP Format String

Exploit for multiple platform in category remote exploits // Should bypass ASLR/NX just fine // This exploit utilizes PHP's internal "%Z" zval // format specifier in order to achieve code-execution. // We fake an object-type zval in memory and then bounce // through it carefully. First though, we...

PHP 5.5.33/7.0.4 - SNMP Format String

// Should bypass ASLR/NX just fine // This exploit utilizes PHP's internal "%Z" zval // format specifier in order to achieve code-execution. // We fake an object-type zval in memory and then bounce // through it carefully. First though, we use the same // bug to leak a pointer to the string itsel...