DllNotificationInjection

DllNotificationInjection Contributori principali Descrizione DllNotificationInection è un POC di una nuova tecnica di processo injection "senza thread" che funziona sfruttando il concetto di DLL Notification Callback in processi locali e remoti. Un post di blog accompagnatorio con maggiori dettag...

NovaLdr

NovaLdr ⚜️ NovaLdr ist ein Threadless Module Stomping, geschrieben in Rust, konzipiert als Lernprojekt zur Erkundung der Welt der Malware-Entwicklung. Es verwendet fortgeschrittene Techniken wie indirekte Syscalls und String-Verschlüsselung, um seine Funktionalitäten zu erreichen. Dieses Projekt...

RemoteTLSCallbackInjection

Maldev Academy - RemoteTLSCallbackInjection Collegamenti rapidi Maldev Academy Home Programma di Maldev Academy Moduli correlati di Maldev Academy Nuovo Modulo 34: Callback TLS per Anti-Debugging Nuovo Modulo 35: Threadless Injection Panoramica Questo metodo utilizza i callback TLS per eseguire u...

LdrShuffle

LdrShuffle Esecuzione furtiva del codice tramite modifica del EntryPoint dei moduli caricati in fase di runtime. Riepilogo I processi Windows hanno vari moduli caricati in fase di runtime. Ognuno di questi moduli ha una funzione DllMain definita, che verrà invocata alla creazione/distruzione del...

CVE-2026-19206

CVE-2026-19206 affects MZ Automation libiec61850 up to 1.6.1 , specifically the SVReceiver_stopThreadless function in the ASDU Element Handler (src/sampled_values/sv_subscriber.c). The issue is a heap-based buffer overflow caused by manipulation of the code path, with a local attack vector and a ...

CVE-2026-19206 MZ Automation libiec61850 ASDU Element sv_subscriber.c SVReceiver_stopThreadless heap-based overflow

A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiverstopThreadless of the file src/sampledvalues/svsubscriber.c of the component ASDU Element Handler. Performing a manipulation results in heap-based buffer overflow. The attack must be...

RemoteTLSCallbackInjection - Utilizing TLS Callbacks To Execute A Payload Without Spawning Any Threads In A Remote Process

This method utilizes TLS callbacks to execute a payload without spawning any threads in a remote process. This method is inspired by Threadless Injection as RemoteTLSCallbackInjection does not invoke any API calls to trigger the injected payload. Quick Links Maldev Academy Home Maldev Academy...