79 matches found
NimGetSyscallStub
NimGetSyscallStub 새로운 ntdll.dll 복사본에서 새로운 Syscall을 가져옵니다. 이 코드는 이미 발표된 훌륭한 도구인 NimlineWhispers 및 NimlineWhispers2 @ajpc500 제작 또는 ParallelNimcalls의 대안으로 사용할 수 있습니다. Syscall을 동적으로 가져오는 장점은 Stub의 시그니처가 파일에 포함되지 않으며, Windows 버전이 변경될 때 걱정할 필요가 없다는 것입니다. 셸코드 실행 템플릿을 컴파일하려면 다음을 실행하세요: root@kitploit: nim...
USB Spy
USB SPY usb-spy 는 WiFi 또는 Ethernet 지원 마이크로컨트롤러를 기반으로 구축된 USB 대용량 저장소 트래픽 분석기입니다. 이 보드는 디스크 이미지FAT 또는 모든 파일시스템를 대상 시스템에 가짜 USB 대용량 저장소 장치로 노출하며, 실제 저장 데이터는 WiFi 또는 Ethernet을 통해 원격 서버에서 제공됩니다. 이러한 구성 덕분에 usb-spy는 대상 시스템이 수행하는 모든 블록 접근을 가로채고 분석할 수 있습니다. 단순한 원시 블록 수준 추적 외에도 usb-spy는 파일시스템을 이해하고 각 접근된...
SysWhispers4
SysWhispers4 AV/EDR回避：直接的・間接的システムコールによる Windows NT 3.1 から Windows 11 24H2 · x64 · x86 · WoW64 · ARM64 SysWhispers4 は、Python ベースの syscall スタブ生成ツールで、ntdll.dll に AV/EDR 製品が仕掛けたユーザーモードフックを回避し、NT カーネル関数を直接呼び出すための C/ASM コードを生成します。 SysWhispers → SysWhispers2 → SysWhispers3 の系譜を引き継ぎ、本バージョンはこれまでで最も包括的な SS...
Malicious code in datacamp-light (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dbdcc4ef12aca6461f8e765976a7b2b33099a1791a7aee7e353371b7954a91c Package impersonates the DataCamp brand while shipping near-empty stub exports index.js init/helper return trivial constants. The postinstall lifecyc...
MAL-2026-4348 Malicious code in api-rs-node (npm)
A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...
Malicious code in api-rs-node (npm)
A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...
MAL-2026-4350 Malicious code in clobprice.api (npm)
A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...
Malicious code in clobprice.api (npm)
A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...
MAL-2026-4349 Malicious code in clob.api (npm)
A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...
Malicious code in clob.api (npm)
A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...
MAL-2026-4347 Malicious code in @devcarron/clob (npm)
A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...
MAL-2026-4502 Malicious code in bucket-protocol-sdk-v2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e19ff8a6cb5a08bd0561658d41dfe3616f1680bc5acac989c97da38f37ee41b4 bucket-protocol-sdk-v2 advertises itself as a 'community maintained drop-in replacement' for the Sui ecosystem's bucket-protocol-sdk, but its src/ tr...
Malicious code in @tanstack/start-fn-stubs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e25d3624c39cfe3dae76a5630525e72d3f0fe2f8eb1bbb44a0ff17c3a39d4fe2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-3488 Malicious code in @tanstack/start-fn-stubs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e25d3624c39cfe3dae76a5630525e72d3f0fe2f8eb1bbb44a0ff17c3a39d4fe2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
public_disclosures
Public vulnerability disclosures Contains some of my vulnerab...
GHSA-X442-M7CC-HR92 kora-lib: Unrecognized Instruction Types Create Empty Stubs That Bypass Fee Payer Policy
Summary When inner CPI instructions use instruction types not recognized by Kora's parser including Token-2022 extension instructions like ConfidentialTransfer, TransferFeeExtension::WithdrawWithheldTokens, etc., they are reconstructed as stub instructions with empty accounts and empty data. Thes...
SUSE-SU-2026:20149-1 Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 16)
This update for the SUSE Linux Enterprise kernel 6.12.0-160000.5.1 fixes various security issues The following security issues were fixed: - CVE-2024-53164: net: sched: fix ordering of qlen adjustment bsc1246019. - CVE-2025-38500: xfrm: interface: fix use-after-free after changing collectmd xfrm...
Fake OSINT and GPT Utility GitHub Repos Spread PyStoreRAT Malware Payloads
Cybersecurity researchers are calling attention to a new campaign that's leveraging GitHub-hosted Python repositories to distribute a previously undocumented JavaScript-based Remote Access Trojan RAT dubbed PyStoreRAT. "These repositories, often themed as development utilities or OSINT tools,...
Netscaler / Citrix ADC / Gateway Memory Overflow
This is a multi-host, multi-port scanner and auditor for CVE-2025-6543-affected NetScaler devices. Supports SNMP and SSH enumeration with optional CSV reporting and exploit stubs...
