pecli

PEcli Tool to analyze PE files in python 3. Current features : Show information about the file import, exports, resources Search for interesting information in the file abnormal resources, peid... Dump sections or resources Check size Search for a string in the file Installation You can install i...

VectoredOverloading

VectoredOverloading Vectored Overloading is a local PE injection technique that was first observed in the KidKadi malware. It works by manipulating the load of a legitimate DLL using Hardware Breakpoints HWBP and Vectored Exception Handling VEH to change the DLL section object on-the-fly...

SHGenOb

SHGenOB: Shellcode Generator from PIC C Code Introduction SHGenOB is a Python-based tool designed to generate shellcode from Position Independent Code PIC written in C. It automates the process of compiling C code, extracting the .text section, and optionally encrypting the resulting shellcode...

NTDLL-Unhook

NTDLL Unhook proper ntdll .text section unhooking via native api. x86/x64/wow64 supported. How It Works The program walks the PEB to locate ntdll.dll base address and manually parses the PE export table to resolve NT API functions without touching the Import Address Table. It then uses NtOpenFile...

malwoverview

Malwoverview !Alt...

NullSection

NullSection NullSection is an Anti-Reversing tool that applies a technique that overwrites the section header with nullbytes. Install git clone https://github.com/MatheuZSecurity/NullSection cd NullSection gcc nullsection.c -o nullsection ./nullsection Advantage When running nullsection on any EL...

IronPE

IronPE - Minimal Windows PE manual loader written in Rust. Rust PE Loader / Manual Mapping Implementation IronPE is a minimal Windows PE manual loader written in Rust for both x86 and x64 PE files. This project is a Rust reimplementation of my previous project dotNetPELoader , which implemented a...

peanalyzer

peanalyzer Advanced Portable Executable File Analyzer Python 3.5.2 : Tested Working Usage python peanalyzer.py --file file.exe --show all|file-path|general|dos-header|file-header|optional-header|data-directory|section-headers|imports python peanalyzer.py --file file.exe --disassemble all...

ProcessStomping

ProcessStomping A variation of ProcessOverwriting to execute shellcode on an executable's section What is it For a more detailed explanation you can read my blog post Process Stomping, is a variation of hasherezade’s Process Overwriting and it has the advantage of writing a shellcode payload on a...

Huan

Huan Huan is an encrypted PE Loader Generator that I developed for learning PE file structure and PE loading processes. It encrypts the PE file to be run with different keys each time and embeds it in a new section of the loader binary. Currently, it works on 64 bit PE files. How It Works? First,...

CVE-2022-31300

CVE-2022-31300 Haraj Script 3.7 - DM Section Authenticated Stored XSS Exploit Title: Haraj Script 3.7 - Authenticated Stored XSS Date: 2022-06-13 CVE: CVE-2022-31300 Exploit Author: Abdulaziz Saad @b4zb0z Vendor Homepage: https://angtech.org/ Software Link: https://angtech.org/product/view/3...

fleet

뉴스 · 버그 신고 · 문서 · 왜 오픈소스인가? · 아트워크 IT 및 보안 팀을 위한 오픈소스 플랫폼으로, 수천 대의 컴퓨터를 관리합니다. API, GitOps, 웹훅, YAML, 그리고 사람을 위해 설계되었습니다. 무엇을 위한 도구인가요? Fleet은 모든 컴퓨팅 디바이스를 무선으로 보호하고 유지 관리할 수 있는 단일 시스템을 제공합니다. MDM, 패치 작업, 소프트웨어 배포, 그리고 모든 항목 검증을 조직에서 사용하는 모든 OS에 걸쳐 한 곳에서 처리할 수 있습니다. Fleet은 네이티브 운영 체제의 데이터와 이벤트를...

InfectPE

Using this tool you can inject x-code/shellcode into PE file. InjectPE works only with 32-bit executable files. Why you need InjectPE? You can test your security products. Use in a phishing campaign. Learn how PE injection works. ...and so on. In the project, there is hardcoded x-code of...

CVE-2025-25618

CVE-2025-25618 Unifiedtransform v2.0 is vulnerable to Incorrect Access Control, allowing teachers to change the Section Name and Room Number — permissions that should be restricted to administrators. Vendor: Unifiedtransform PoC Step 1: Log in to the application as a Teacher. Step 2: Browse to th...

ModuleShifting

ModuleShifting This tool has been presented at the 2023 x33fcon talk: "Improving the stealthiness of Memory Injection Techniques" Video Blogpost What is it ModuleShifting is stealthier variation of Module Stomping and Module overloading injection technique. It is actually implemented in Python...

elfpack

ElfPack: ELF Binary Section Docking for Stageless Payload Delivery Highlights Overview of payload bundling mechanisms: compilation,linking and loading. Binary compatibility and creation of loosely coupled payloads to their delivery mechanism. Avoiding automatic memory loading of sections. Use of...

CVE-2026-62958

A vulnerability in Libriscv allows the attacker to crash the sandbox using an Out of Bounds Read. To create Bad elf: python3 poc.py samplefile poisonedfile Results: ❯ python3 poc.py fib poisonedfile Manipulating .text section header at offset 0x250 Manipulating .symtab section header at offset...

CVE-2026-6271

CVE-2026-6271 — Career Section WordPress 플러그인 RCE 스캐너 플러그인: Career Section career-section CVE ID: CVE-2026-6271 CVSS 점수: 9.8 Critical CVSS 벡터: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 취약점 유형: 인증되지 않은 임의 파일 업로드 → 원격 코드 실행 영향을 받는 버전: 인증되지 않은 모든 방문자는 유효한 nonce를 얻을 수 있으며 검증 확인을 통과할 수 있습니다. 파일 유형 ...

the-backdoor-factory

The new version of BACKDOOR FACTORY is available! Get access here: https://github.com/sponsors/secretsquirrel WARNING: Pull Requests WILL BE IGNORED AND CLOSED. The Backdoor Factory BDF For security professionals and researchers only. The goal of BDF is to patch executable binaries with user...

pe2pic

English || 简体中文 pe2pic PE 파일용 소형 시각화 도구 시작하기 다음 명령으로 종속성을 설치합니다: pip install -r requirements.txt 사용법 usage: pe2pic.py -h --infile INFILE --outfile OUTFILE --double --minheight MINHEIGHT PE visualizer options: -h, --help show this help message and exit --infile INFILE Input file --outfile OUTFILE...