SysWhispers3

SysWhispers3 SysWhispers 通过生成头文件/ASM 文件帮助规避检测，使植入程序能够直接进行系统调用。 官方 Discord 频道 快来 Discord 一起玩吧！ 我为什么不为 SysWhispers2 创建 PR？ SysWhispers3 作为独立版本的原因有很多，但最重要的包括： SysWhispers3 是 Inceptor 使用的“事实分支”，并实现了一些与原始版本工具无关的实用类。 SysWhispers2 正朝着支持 NASM 编译（用于 gcc/mingw）的方向发展，而此版本专门设计并测试支持 MSVC（因为 Inceptor...

rsyscall

Resumen rsyscall es una biblioteca que proporciona una interfaz a un subconjunto en constante crecimiento de las llamadas al sistema de Linux. Esta interfaz es: independiente del proceso : todas las llamadas al sistema se invocan como métodos sobre objetos de proceso, los cuales pueden referirse ...

MalDev

MalDev Ehi! Benvenuto nel mio repo : Sono Captain Magma, un appassionato dedicato alla cybersecurity, allo sviluppo di malware e all'analisi. Lo scopo di questo repository è gestire il mio percorso di apprendimento su MalDev mentre studio e aggiorno questo repository con i miei appunti e codice...

osx-re-101

osx & ios re 101 Lavori in corso, li sto raccogliendo attivamente. Da leggere assolutamente https://reverse.put.as/ https://blog.paloaltonetworks.com/tag/mac-os-x/ https://www.synack.com/blog/r-d-projects/os-x-security-research/ https://pewpewthespells.com/re.html https://github.com/bx/machO-tool...

SysWhispers2

SysWhispers2 SysWhispers aiuta nell'evasione generando file header/ASM che gli implant possono utilizzare per effettuare chiamate di sistema dirette. Tutte le syscall principali sono supportate e nella cartella example-output/ sono disponibili file generati di esempio. Differenza tra SysWhispers ...

BestEdrOfTheMarket

Miglior EDR del Mercato BEOTM V3 🐲🏴‍☠️ Best Edr Of The Market è un laboratorio open-source progettato per implementare e comprendere, da una prospettiva di basso livello, i metodi di rilevamento utilizzati dai prodotti di sicurezza Endpoint Detection & Response e le loro soluzioni alternative...

tiny_tracer

tinytracer A Pin Tool for tracing: API calls, including input and output of selected functions defined local functions, and functions from statically linked libraries selected instructions: RDTSC, CPUID, INT inline system calls, including parameters of selected syscalls transition between section...

SysWhispers4

SysWhispers4 Évasion AV/EDR via appels système directs et indirects Windows NT 3.1 à Windows 11 24H2 · x64 · x86 · WoW64 · ARM64 SysWhispers4 est un générateur de stubs d'appels système basé sur Python qui produit du code C/ASM pour invoquer directement les fonctions du noyau NT, en contournant l...

gustave

c Airbus 2021, sduverger GUSTAVE - Embedded OS kernel fuzzer What is it ? GUSTAVE is a fuzzing platform for embedded OS kernels. It is based on QEMU and AFL and all of its forkserver siblings. It allows to fuzz OS kernels like simple applications. Thanks to QEMU, it is multi-platform. One can see...

tracee

Before moving on, please consider giving us a GitHub star ⭐️. Thank you! About Tracee Tracee is a runtime security and observability tool that helps you understand how your system and applications behave. It is using eBPF technology to tap into your system and expose that information as events tha...

CallStackSpoofer

CallStackSpoofer Questo repository dimostra un'implementazione PoC per spoofare call stack arbitrarie quando si effettuano chiamate di sistema. Per una descrizione tecnica completa, consulta il post del blog qui: https://labs.withsecure.com/blog/spoofing-call-stacks-to-confuse-edrs. Di default...

LetMeowIn

LetMeowIn Un dump di LSASS sofisticato e furtivo che utilizza C++ e MASM x64. Come visto su Binary Defense e Cyber Security News Esclusione di responsabilità Non essere malvagio con questo. Ho creato questo strumento per imparare. Non sono responsabile se i federali bussano alla tua porta...

PT-2026-79296

Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possible kernel heap corruption. Scenario caused by memory free paths not maintaining state data of upgraded higher order allocations. This could cause memory leak or double free even...

CVE-2026-49428

In FreeBSD's posixshm module, open(2) with O_TRUNC and fspacectl(2) failed to verify whether operations are permitted on largepage objects, incorrectly freeing kernel memory. An unprivileged local user can read freed kernel memory and escalate privileges. Affected: all supported versions prior to...

EUVD-2026-54956

A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0. This impacts the function fs.writeFileSync/fs.existsSync/fs.readFileSync of the file index.ts of the component geminithinking. This manipulation of the argument sessionCommand/sessionPath causes path traversal. The attack requires...

CVE-2026-45204

Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kernel null pointer dereference in an error path. Null pointer dereference occurs in an error path of a function running in kernel thread of execution leading to kernel exceptions,...

EUVD-2026-54348

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in certain cases cause GPU UAF of arbitrary pages. Incorrect validation of array index can lead to OOB read and potentially to GPU UAF of arbitrary pages...

Important: Red Hat Security Advisory: rhc security update

An update for rhc is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

CVE-2026-49743

Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs. During workload submission involving a fence exported by the GPU driver, the reference count of the underlyin...

Injection fast-uri Dependency in Confluence Data Center

This High severity Injection vulnerability was introduced in versions 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Injection vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N allows an...