57 matches found
p-invoke.net
p-invoke.net This repository contains most of the P/Invoke definitions from the most-of-the-time offline pinvoke.net, adding the link to the Microsoft documentation for each one. The Gitbook is available at https://ricardojoserf.gitbook.io/pinvoke. Notes I did this to check some definitions in a...
thematrix
TheMatrix This project was created to ease the malware analysis process. The goal is to create an activator binary whose purpose is to load a user defined binary and monitor the execution by using Win32 API hooks. Relevant data is then saved to disk. The code supports both x86 and x64 binaries. D...
D1rkSleep
D1rkSleep نسخة محسّنة من EKKO بواسطة @5pider تقوم بتشفير أقسام الصورة فقط. تقنية إخفاء النوم التي تستخدم Win32 API الخاصة بـ CreateTimerQueueTimer. الاعتمادات: https://github.com/Cracked5pider/Ekko...
C2-Hunter
C2-Hunter C2-Hunter is a program designed for malware analysts to extract Command and Control C2 traffic from malwares in real-time. The program uses a unique approach by hooking into win32 connections APIs. With C2-Hunter, malware analysts can now intercept and analyze communication in real-time...
charlotte
charlotte c++ shellcode launcher completamente non rilevato ; rilasciato per celebrare la nascita del mio neonato descrizione 13/05/2021: 1. shellcode launcher in c++, completamente non rilevato 0/26 al 13 maggio 2021. 2. invocazione dinamica delle funzioni API win32 3. crittografia XOR dello...
CVE-2024-4577-checker
Checker per la vulnerabilità CVE-2024-4577 Il Checker per la vulnerabilità CVE-2024-4577 è uno script Bash progettato per scansionare più domini alla ricerca della vulnerabilità CVE-2024-4577 in PHP-CGI. Questo strumento consente a ricercatori di sicurezza e amministratori di sistema di valutare...
XeytanWin32-RAT
AVVERTENZA Questo è un RAT difettoso, non completato, non stabile. È ancora un'applicazione "work in progress". Introduzione Progetto creato per ammazzare parte del mio tempo libero, non è mantenuto attivamente. Ci sono molte cose da migliorare/correggere, e ci vorrà tempo per raggiungere una...
Ekko
Ekko Una piccola tecnica di offuscamento della sleep che utilizza l'API Win32 CreateTimerQueueTimer. Prova di concetto. Può essere fatta meglio. NOTA Questa implementazione ha dei difetti noti. Quindi non consiglierei di usarla senza sapere come funziona o sapere come individuare e correggere...
staged-DLL-Injection-SMB-
staged-DLL-Injection Proof-of-Concept für gestaffelte DLL-Injektion in C mit Win32-APIs – entwickelt in einer isolierten Laborumgebung für das Studium der Red-Team-Zertifizierung CRTO. ⚠️ Haftungsausschluss: Dieses Projekt wurde ausschließlich in einer isolierten Laborumgebung zu Bildungszwecken i...
wasmforge
WasmForge WasmForge compila programmi Go e C in WebAssembly, poi li impacchetta come singoli binari nativi. Gli eseguibili risultanti isolano il codice guest all'interno di un runtime WASM un fork per build di wazero. Dall'interno di quel sandbox, i guest ottengono accesso trasparente a networkin...
charlotte
charlotte c++ fully undetected shellcode launcher ; releasing this to celebrate the birth of my newborn description 13/05/2021: 1. c++ shellcode launcher, fully undetected 0/26 as of 13th May 2021. 2. dynamic invoking of win32 api functions 3. XOR encryption of shellcode and function names 4...
TokenPlayer
TokenPlayer Manipolazione e abuso dei token di accesso di Windows. TokenPlayer è solo un piccolo strumento che ho realizzato per imparare la programmazione dell'API win32 e comprendere meglio il modello dei token di accesso di Windows. Caratteristiche: Rubare e impersonare i token primari...
Exploit for OS Command Injection in Php
CVE-2024-4577 usage: CVE-2024-4577.py -h -v RHOST RPO...
PHP 8.3.x < 8.3.12 Multiple Vulnerabilities
The version of PHP installed on the remote host is prior to 8.3.12. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.12 advisory. - In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, when using a certain non- standard configurations ...
Exploit for OS Command Injection in Php
PHP CGI Argument Injection CVE-2024-4577 RCE 📜 Descripti...
CVE-2024-4577 Argument Injection in PHP-CGI
In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may...
CVE-2024-4577 Argument Injection in PHP-CGI
In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may...
CVE-2024-4577
In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may...
Microsoft Windows UTF-8 Buffer Overruns Exploit
When Microsoft released UTF-8 support for the -A interfaces of the Windows API, it appears to have introduced buffer overrun conditions. Hi @ll, almost 4 years ago, with Windows 10 1903, after more than a year beta-testing in insider previews, Microsoft finally released UTF-8 support for the -A...