| // | |
| // dotdot.m | |
| // dotdot | |
| // | |
| // Created by roooot on 03.08.26. | |
| // Copyright (C) 2026 roooot | |
| // | |
| // This program is free software: you can redistribute it and/or modify | |
| // it under the terms of the GNU Affero General Public License as published | |
| // by the Free Software Foundation, either version 3 of the License, or |
A structured overview of the BloodHound attack-path analysis ecosystem — official ingestors, community collectors, converters, ADWS alternatives, analysis tools, deployment helpers, and supporting frameworks.
Legend
- 🟢 Official — maintained by SpecterOps
- 🔵 Community — third-party / unofficial
| /* | |
| * gro_frag.c — LPE via GRO managed-frag UAF (io_uring SEND_ZC + veth) | |
| * | |
| * The bug: skb_gro_receive() copies frag descriptors from a ZC skb | |
| * (SKBFL_MANAGED_FRAG_REFS → no per-frag page refs) into a non-ZC | |
| * GRO accumulator. When the accumulator is freed, skb_release_data() | |
| * calls put_page() on each frag — including the stolen ones that never | |
| * had get_page() called. This gives us one extra put_page per merged | |
| * ZC frag: a refcount underflow. | |
| * |
| /* | |
| * sockmap_lpe_ktls.c — full LPE via kTLS + sockmap page cache corruption | |
| * | |
| * https://lore.kernel.org/stable/20260517121626.406516-1-rollkingzzc@gmail.com/ | |
| * | |
| * Works on ALL kernels 4.18+ (including 6.5+ where sendpage was removed). | |
| * | |
| * Chain: sendfile → tls_sw_sendmsg(MSG_SPLICE_PAGES) | |
| * → tls_sw_sendmsg_splice → sk_msg_page_add(msg_pl, page) | |
| * → bpf_exec_tx_verdict(msg_pl) |
| #!/usr/bin/env bash | |
| # vm-type — type a hardcoded password into maldev101 via send-key | |
| # Usage: ./vm-type.sh (click into password field first) | |
| set -euo pipefail | |
| ############################################### | |
| # PUT YOUR PASSWORD HERE | |
| PASSWORD='CHANGE_ME' | |
| ############################################### |
| #!/bin/sh | |
| # watch_host.sh — full traffic + C2 monitor for a single host | |
| # Usage: sh watch_host.sh <target_ip> [interface] | |
| TARGET="${1:-1.1.1.1}" | |
| IFACE="${2:-vio0}" | |
| echo "==========================================" | |
| echo " Host Monitor Target:$TARGET Iface:$IFACE" | |
| echo " Started: $(date)" | |
| echo "==========================================" |
| # script to scan MS Office files, looking for "Shell.Explorer" OLE objects which could match CVE-2026-21509 | |
| # using oletools - https://github.com/decalage2/oletools | |
| # Philippe Lagadec 2026-01-28 | |
| # NOTES: | |
| # According to the MS advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509 | |
| # the CVE-2026-21509 vulnerability is related to CLSID "EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B", | |
| # corresponding to the "Shell.Explorer" COM object, which can be used to open the legacy | |
| # Internet Explorer engine (aka Trident/MSHTML) from any application. | |
| # So to exploit CVE2026-21509 from a MS Office document, one could use either an OLE object |
| # ms-block.ps1 - Windows telemetry/AI blocker (idempotent, no dupes) | |
| # Run as Administrator | |
| $hostsPath = "$env:windir\System32\drivers\etc\hosts" | |
| $marker = "# --- MS-BLOCK START ---" | |
| $endMarker = "# --- MS-BLOCK END ---" | |
| # Exclude hosts file from Defender | |
| Add-MpPreference -ExclusionPath $hostsPath -ErrorAction SilentlyContinue | |
| # Read current hosts, strip any previous MS-BLOCK section |
| /* | |
| * Callback Chaining PoC - Windows API Callback Chain Execution | |
| */ | |
| #include <Windows.h> | |
| #include <dbghelp.h> | |
| #include <powrprof.h> | |
| #include <stdio.h> | |
| #pragma comment(lib, "user32.lib") |
