doublepulsar-c2-traffic-decryptor

Autor: Luke Jennings [email protected] - @jukelennings Empresa: Countercept @countercept Sitio web: https://countercept.com Un script de python2 para descifrar el tráfico C2 utilizado por el implante SMB DOUBLEPULSAR desde un archivo PCAP. El cifrado usado es un simple XOR de 4 bytes, que a...

LoadReload

LoadReload Shellcode 加载器（基于我为硕士论文所做的工作），专为 Sliver-Shellcode 设计（小于 25MB……）。 !Note 功能特性： 多字节异或解密载荷 本地获取载荷 通过 KUSERSHAREDDATA 的 BusySleep 函数实现反仿真 用于 EDR 去条件化/消耗内存扫描器资源的 RW-RX 循环 预加载网络 DLL 以防范行为警报，例如“来自被篡改模块的网络模块” 操作员选择的诱饵 DLL 的模块重载（当前为 edgehtml.dll） 通过 API 哈希和动态 API 解析实现 IAT 混淆 通过 LdrCallenclave 执行...

CobaltStrikeParser

CobaltStrikeParser 用于解析 CobaltStrike Beacon 配置的 Python 解析器 描述 使用 parsebeaconconfig.py 解析无阶段 beacon、内存转储或 C2 URL，默认启用 Metasploit 兼容模式（默认 true）。 许多无阶段 beacon 是 PE 文件，其中 beacon 代码本身存储在 .data 段中，并通过 4 字节密钥进行异或加密。 该脚本尝试启发式地查找异或密钥和数据，解密数据并从中解析配置。 此设计也支持作为库使用。 该仓库现在还包括一个小的通信模块（comm.py），可以帮助作为 beacon 与 C...

VULNERAVEL-CVE-2018-14847---CREDENCIAIS-EXTRAIDAS

Herramientas de Pentest — /red Repositorio de scripts para auditoría y pruebas de penetración en redes. Úselo únicamente en dispositivos con autorización formal. CVE-2018-14847 — Extractor de Credenciales de Winbox MikroTik Descripción Explota la vulnerabilidad de lectura de archivo no autenticad...

CVE-2022-1257

CVE-2022-1257 PoC: Recolección de credenciales de la base de datos del agente McAfee Creado por scottk817 Este script es un PoC para CVE-2022-1257 , una vulnerabilidad en el agente McAfee agente Trellix al trabajar con su base de datos. La vulnerabilidad permite a los atacantes recuperar y...

KPOT-string-decrypter

KPOT-string-decrypter IDA python scripts for decrypting KPOT stealer's strings and setting those as comments next to the var that would receive them during runtime. It works as follows: Gets the offset that's passed on eax to either decryption function there are two, which is why this repo has tw...

Webmin_Exploit_reverse_shell

Introducción: El Webmin Exploit es un exploit dirigido al servicio Webmin, que puede ser explotado en versiones antiguas de Webmin. Este exploit utiliza diversas técnicas para ejecutar código malicioso y obtener acceso no autorizado al sistema objetivo. Implica: El uso tanto de código C como...

MAL-2026-12318 Malicious code in @hoteldev/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bb27849cbb16840b019ef47d6a84627d61eb9d48df28da5a9bc1a208e1ff758 build/index.js appends an evalatob... block after the normal exportStar section that decodes to an import-time loader. The loader resolves a C2 IP by...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Malicious code in theme-color-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7a4ba7e8664b9e1d99c4018963a4731d591653d7f2a9b879ba090e7a7f6e7bd Although the package presents itself as a 'theme color picker', package.json identifies the publisher as analysis-chart.io with repository...

Malicious code in package-uploader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69b86134d9cd019c2d8ad172eed54cd4a48839d69ed2c6af52b79ef5080da765 [email protected] ships an install-hook.js that runs automatically as the npm postinstall script package.json declares "postinstall": "node...

MAL-2026-5790 Malicious code in ldpbootstrap-jquery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcab02ae44d1604b6fa9e80156a8c5882f7a4809470ff59eb6d14db4bf28f91f ldpbootstrap-jquery ships and executes an obfuscated Windows PowerShell payload as part of its documented usage. The package contains...

DuneQuixote campaign targets Middle Eastern entities with “CR4T” malware

Introduction In February 2024, we discovered a new malware campaign targeting government entities in the Middle East. We dubbed it "DuneQuixote"; and our investigation uncovered over 30 DuneQuixote dropper samples actively employed in the campaign. These droppers, which exist in two versions –...