IronPE

IronPE - Minimal Windows PE manual loader written in Rust. Rust PE Loader / Manual Mapping Implementation IronPE is a minimal Windows PE manual loader written in Rust for both x86 and x64 PE files. This project is a Rust reimplementation of my previous project dotNetPELoader , which implemented a...

advisories

This repository does not have a README...

malwoverview

Malwoverview !Alt...

VectoredOverloading

VectoredOverloading Vectored Overloading is a local PE injection technique that was first observed in the KidKadi malware. It works by manipulating the load of a legitimate DLL using Hardware Breakpoints HWBP and Vectored Exception Handling VEH to change the DLL section object on-the-fly...

Huan

Huan Huan es un generador de cargadores PE cifrados que desarrollé para aprender la estructura de archivos PE y los procesos de carga de PE. Cifra el archivo PE que se ejecutará con diferentes claves cada vez y lo incrusta en una nueva sección del binario del cargador. Actualmente, funciona con...

WindowsPatchDetector

Experimental Windows .text section Patch Detector ====================== Experimental: Windows .text section compare - disk versus memory Original Idea After reading about the Skeleton Key malware http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis/ develop ...

CVE-2025-25618

CVE-2025-25618 Unifiedtransform v2.0 is vulnerable to Incorrect Access Control, allowing teachers to change the Section Name and Room Number — permissions that should be restricted to administrators. Vendor: Unifiedtransform PoC Step 1: Log in to the application as a Teacher. Step 2: Browse to th...

elfpack

ElfPack: ELF Binary Section Docking for Stageless Payload Delivery Highlights Overview of payload bundling mechanisms: compilation,linking and loading. Binary compatibility and creation of loosely coupled payloads to their delivery mechanism. Avoiding automatic memory loading of sections. Use of...

SHGenOb

SHGenOB: Shellcode Generator from PIC C Code Introduction SHGenOB is a Python-based tool designed to generate shellcode from Position Independent Code PIC written in C. It automates the process of compiling C code, extracting the .text section, and optionally encrypting the resulting shellcode...

CVE-2022-31300

CVE-2022-31300 Haraj Script 3.7 - DM Section Authenticated Stored XSS Exploit Title: Haraj Script 3.7 - Authenticated Stored XSS Date: 2022-06-13 CVE: CVE-2022-31300 Exploit Author: Abdulaziz Saad @b4zb0z Vendor Homepage: https://angtech.org/ Software Link: https://angtech.org/product/view/3...

CVE-2022-40317

CVE-2022-40317 Stored XSS in Notes A stored XSS was found in the notes section of the application while we were pentesting a client that was using OpenKM. Basically, when storing notes, somehow normal HTML was allowed and it was rendered as is. As you know, However, we found that using...

pe2pic

English || 简体中文 pe2pic Small visualizator for PE files Getting started Install the dependencies by: root@kitploit: pip install -r requirements.txt Usage root@kitploit: usage: pe2pic.py -h --infile INFILE --outfile OUTFILE --double --minheight MINHEIGHT PE visualizer options: -h, --help show this...

NullSection

NullSection NullSection es una herramienta anti-reversing que aplica una técnica que sobrescribe el encabezado de la sección con bytes nulos. Instalación root@kitploit: git clone https://github.com/MatheuZSecurity/NullSection cd NullSection gcc nullsection.c -o nullsection ./nullsection Ventaja A...

CVE-2024-41504

CVE-2024-41504 CVE: CVE-2024-41504 ソフトウェア: Jetimob Plataforma Imobiliaria CRM/ERP/CMS バージョン: 20240627-0 脆弱性: 保存型クロスサイトスクリプティング XSS 説明: アプリケーションの「Oportunidades」セクションで「Atividade」活動を作成または編集する際、フォームフィールド「Descrição」によりJavaScriptコードの注入が可能になります。ペイロードを含む活動が読み込まれるたびに、そのコードが実行されます。 ペイロード:...

fleet

ニュース · バグを報告 · ドキュメント · なぜオープンソースなのか？ · アート IT・セキュリティチームが何千台ものコンピューターを管理するためのオープンソースプラットフォーム。API、GitOps、Webhook、YAML、そして人間のために設計されています。 何のためにあるのか？ Fleetは、すべてのコンピューティングデバイスをリモート（OTA）でセキュリティ保護・管理するための単一のシステムを提供します。MDM、パッチ適用、ソフトウェア展開、あらゆる検証を、組織で使用するすべてのOSにわたって、1つの場所から実行できます。...

NTDLL-Unhook

NTDLL Unhook proper ntdll .text section unhooking via native api. x86/x64/wow64 supported. How It Works The program walks the PEB to locate ntdll.dll base address and manually parses the PE export table to resolve NT API functions without touching the Import Address Table. It then uses NtOpenFile...

CVE-2026-90830

A flaw was found in GNU Binutils. This vulnerability, located in the bfdwritemergedsection function within the Section Merge component, allows a local attacker to trigger a null pointer dereference. This can lead to a denial of service DoS condition, making the affected system or application...

CVE-2026-90829

A flaw was found in GNU Binutils. A local attacker can exploit this vulnerability by manipulating the SHTGROUP Section. This manipulation can lead to a null pointer dereference within the bfdelfsetgroupcontents function. The primary consequence of this flaw is a denial of service...

Icedid-file-decryptor

IcedID Decryptor A script to statically decrypt license.dat files associated with IcedID infections. The script will also decrypt the .data section from unpacked IcedID samples. Notes: The script will automatically detect whether a PE file or license.dat file has been given. If a PE has been...

RiteCMS 3.0.0 - Cross-site Scripting

RiteCMS v3.0.0 contains a reflected XSS caused by unsanitized input in the mainmenu/editsection component, letting attackers execute arbitrary scripts in the context of the victim's browser. id: CVE-2024-28623 info: name: RiteCMS 3.0.0 - Cross-site Scripting author: 0xAkoko severity: medium...