barq

barq barq: AWS 클라우드 사후 침투 프레임워크! 무엇인가요? barq는 실행 중인 AWS 인프라에 대한 공격을 쉽게 수행할 수 있는 사후 침투 프레임워크입니다. 원래 인스턴스 SSH 키페어 없이도 실행 중인 EC2 인스턴스를 공격할 수 있습니다. 또한 AWS에 저장된 Secrets 및 Parameters를 열거하고 추출할 수 있습니다. 사전 요구 사항 기존 AWS 계정 액세스 키 ID와 시크릿 경우에 따라 토큰도 포함 Python 2 또는 3. 둘 다에서 실행 가능합니다. msfvenom 페이로드를 실행하려면...

Ninja

快速更新，包含 Follina 利用（2022-06-01）- NinjaC2 将生成文档并提供 HTML 负载。 更多信息：https://www.linkedin.com/posts/ahmed-khlief-499321a7i-just-pushed-a-quick-update-to-ninjac2-to-activity-6937661951007170560-Tmps Ninja V2.2 发布（2022-03-27）。 新功能包括： 查看 URL 获取功能详情以及如何使用 AWS EC2 自动化： 1. CNC 脚本的新用户界面 2...

chameleon

19 Customizable honeypots for monitoring network traffic, bots activities, and username\password credentials DNS, HTTP Proxy, HTTP, HTTPS, SSH, POP3, IMAP, STMP, RDP, VNC, SMB, SOCKS5, Redis, TELNET, Postgres, MySQL, MSSQL, Elastic and ldap If you want to implement the honeypots in your project,...

CVE-2021-3456

CVE-2021-3456 무해한 PDF 파일에서 시작하여 AWS EC2 인스턴스에서 리버스 셸로 이어지는 실용적인 공격 체인 시작: PDF 페이로드 제작 공격의 최전선에서 모든 것이 시작됩니다. PowerShell에 내장된 WScript 개체를 사용하여 Windows 호스트에 전달될 PDF 내부에 스크립트를 삽입합니다. 페이로드는 원격 HTTP 엔드포인트에서 실행 파일을 가져와 로컬 파일 시스템에 기록합니다. $payload = @" var wsh = WScript.CreateObject"WScript.Shell";...

metabadger

Metabadger Prevent SSRF attacks on AWS EC2 via automated upgrades to the more secure Instance Metadata Service v2 IMDSv2. Metabadger Purpose and functionality Diagnose and evaluate your current usage of the AWS Instance Metadata Service along with understanding how the service works Prepare you t...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: runc, amazon-k8s-cni, ctop, nri-apache, containerd, k9s, nri-elasticsearch, flux, omnibump, crossplane-provider-azure-sql, glab, crossplane-provider-azure-storage, dapr, harbor, opa-envoy, vcluster, crossplane, docker-machine-driver-harvester, hcloud,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, containerd, k9s, buildkitd, flux, crossplane-provider-azure-sql, glab, crossplane-provider-azure-storage, kargo, docker-compose, fscrypt, cilium-cli, hcloud, terragrunt, pulumi-language-yaml, witness, crossplane-provider-azure-managedidentity...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: runc, local-static-provisioner, kapp, ctop, mesosphere-vsphere-csi, sonobuoy, crossplane-provider-azure-sql, s5cmd, cilium-cli, azure-workload-identity-webhook, grafana-rollout-operator, ingress-nginx-controller, crossplane-provider-sql,...

Malicious code in zer0onetencent2 (npm)

The zer0onetencent2 package was published to the npm registry by user 't2423048543' maintainer email [email protected]. It is described as 'A simple date formatting utility' but ships no such functionality; index.js only exports a hello stub returning the package name, indicating a package...

Aider has an SSRF vulnerability through its AWS EC2 Metadata Endpoint

A security vulnerability has been detected in Aider-AI Aider 0.86.3.dev. This affects the function requests.get of the file apidocs.py of the component AWS EC2 Metadata Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit...

Aider has an SSRF vulnerability through its AWS EC2 Metadata Endpoint

A security vulnerability has been detected in Aider-AI Aider 0.86.3.dev. This affects the function requests.get of the file apidocs.py of the component AWS EC2 Metadata Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit...

go-witness is Vulnerable to Improper Verification of AWS EC2 Identity Documents

Impact This vulnerability only affects users of the AWS attestor. Users of the AWS attestor could have unknowingly received a forged identity document. While this may seem unlikely, AWS recently issued a security bulletin about IMDS Instance Metadata Service impersonation.^1 There are multiple...

Daas unable to create host connection with error: "URL invalid"

Unable to create a host connection to AWS EC2 and on-premises hypervisors XenServer, VMWare, etc. with invalid URL or authentication failure when a proxy has been configured for the Network Service account...

Ladder v0.0.21 - Server-side request forgery Vulnerability

Exploit Title: Ladder v0.0.21 - Server-side request forgery SSRF Date: 2024-01-20 Exploit Author: @chebuya Software Link: https://github.com/everywall/ladder Version: v0.0.1 - v0.0.21 Tested on: Ubuntu 20.04.6 LTS on AWS EC2 ami-0fd63e471b04e22d0 CVE: CVE-2024-27620 Description: Ladder fails to...

Ladder 0.0.21 Server-Side Request Forgery

Exploit Title: Ladder v0.0.21 Server-side request forgery SSRF Date: 2024-01-20 Exploit Author: @chebuya Software Link: https://github.com/everywall/ladder Version: v0.0.1 - v0.0.21 Tested on: Ubuntu 20.04.6 LTS on AWS EC2 ami-0fd63e471b04e22d0 CVE: CVE-2024-27620 Description: Ladder fails to app...

Indonesian Cybercriminals Exploit AWS for Profitable Crypto Mining Operations

A financially motivated threat actor of Indonesian origin has been observed leveraging Amazon Web Services AWS Elastic Compute Cloud EC2 instances to carry out illicit crypto mining operations. Cloud security company's Permiso P0 Labs, which first detected the group in November 2021, has assigned...

Threat Actors Target AWS EC2 Workloads to Steal Credentials

We found malicious samples attempting to steal Amazon Elastic Compute Cloud EC2 Workloads' access keys and tokens via typosquatting and the abuse of legitimate tools...

8x8: Subdomain takeover of ████.jitsi.net

Summary █████.jitsi.net points to an AWS EC2 instance at 18.195.93.116 that no longer exists. I was able to take control of this IP address and run my own EC2 instance. I can now serve content on this domain, obtain a TLS certificate for this domain, etc. If any customers or servers are pointing ...

Zomato: Subdomain takeover of fr1.vpn.zomans.com

Summary fr1.vpn.zomans.com points to an AWS EC2 instance at 52.47.57.107 that no longer exists. I was able to take control of this IP address and run my own EC2 instance. I can now serve content on this domain, obtain a TLS certificate for this domain, etc. If any customers or servers are pointin...

Zego: Subdomain takeover of v.zego.com

Summary v.zego.com points to an AWS EC2 instance at 52.214.138.192 that no longer exists. I was able to take control of this IP address and run my own EC2 instance. I can now serve content on this domain, obtain a TLS certificate for this domain, etc. If any customers or servers are pointing to...