ccp-p/ghostlock-cve-2026-43499-4.19-k40Android kernel LPE PoC for CVE-2026-43499, an rtmutex use-after-free in 4.19 Qualcomm kernels, adapted for Redmi K40 with LD_PRELOAD root payload.
theflink/deepsleepA variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC
kevoreilly/capev2Malware Configuration And Payload Extraction
kaandemir993/dropper-gcleaner-c2-infrastructure-kernel-driver-powershell-conhost-payload-analysisReverse engineering analysis of Dropper GCleaner, a malware that uses a resilient C2 infrastructure, kernel driver loading, PowerShell/Conhost…
stephenfewer/reflectivedllinjectionReflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a…
commit-regrets/samsung_tizen_tv_rootResearch toolkit that roots a Samsung Tizen 9 TV via a Chromium WasmGC RCE and V4L2 physmap arbitrary physical memory access, with persistent on-boot…
qi4l/jysoDual-purpose JNDI injection and Java deserialization exploitation framework with advanced bypass capabilities for WAF, RASP, and high JDK versions.…
fortra/nanodumpThe swiss army knife of LSASS dumping
kaandemir993/redline-stealer-c2-defender-bypass-payload-analysis"Reverse engineering analysis of RedLine Stealer, a .NET-based info-stealer that uses C2 domains (198.46.86.63, tempuri.org), Windows Defender…
bobikl/cve-2026-43499-t807dAndroid kernel exploit research package for CVE-2026-43499, containing popsicle exploit source, embedded su payload, root bridge helper, and…
kaandemir993/-remcos-rat-fileless-svchost-injection-obfuscated-payload-analysis-"Reverse engineering analysis of a fileless Remcos RAT variant that injects into svchost.exe via Native API calls. Covers obfuscated payload…
dsnezhkov/zombieantZombie Ant Farm: Primitives and Offensive Tooling for Linux EDR evasion.
kudaes/shelterROP-based sleep obfuscation to evade memory scanners
principlecheck/kslkatzbofBeacon Object File for in-line LSASS credential extraction using the KslD.sys BYOVD technique. Extracts NT hashes and cleartext passwords from…
kkent030315/pagetableinjectionCode Injection, Inject malicious payload via pagetables pml4.
kudaes/rustchainHide memory artifacts using ROP and hardware breakpoints.
se1ims/pixelsmashProof-of-concept and lab harness for CVE-2026-8461, an out-of-bounds write in FFmpeg's MagicYUV decoder, with payload generator and Qt demo player.
forrest-orr/artifacts-kitPseudo-malicious usermode memory artifact generator kit designed to easily mimic the footprints left by real malware on an infected Windows OS.
