chisel-ng

| | | | /| ' | / |/ \ | | ' \ / | | | | | | \ / || | | | | | || | ||/ || | | || , | |/ chisel-ng Una implementación en Rust de chisel para pruebas de penetración y operaciones de equipo rojo. Establece túneles inversos sobre SSH sobre WebSocket sobre TLS, permitiendo a los operadores pivotar a...

chisel

Chisel Chiselは、HTTP上で転送され、SSHで保護される高速なTCP/UDPトンネルです。クライアントとサーバーの両方を含む単一の実行ファイルです。Go（golang）で書かれています。Chiselは主にファイアウォールを通過するのに役立ちますが、ネットワークへの安全なエンドポイントを提供するためにも使用できます。 目次 特徴 インストール デモ 使用方法 貢献 変更履歴 ライセンス 特徴 使いやすい 高性能 SSHプロトコル（crypto/ssh経由）を使用した暗号化接続 認証接続;...

Chisel-Strike

Chisel-Strike 一个 .NET XOR 加密的 Cobalt Strike aggressor 实现，用于 chisel，以实现更快的代理和高级 socks5 功能。 为什么写这个？ 根据我的经验，我发现 socks4/socks4a 代理与 socks5 代理相比速度相当慢，而且大多数 C2 框架缺乏对 socks5 的实现。有一个名为 SharpChisel 的 C 包装器，它是 Go 版本 chisel 的封装。这个包装器有一些问题，并且没有更新到其 Go 版本的最新版本。SharpChisel 无法生成与 donut、反射方法或 execute-assembly 兼容...

wp-file-manager-exploit-CVE-2020-25213-with-Zerologon

wp-file-manager-exploit-CVE-2020-25213-with-Zerologon 课程作业项目 NT205.P21.ANTT 网络攻击 利用Zerologon漏洞攻击Windows Server 2019，使用Garble、Chisel、Evil-WinRM、Impacket以及客户端机器上的易受攻击的WordPress插件 视频演示：https://www.youtube.com/watch?v=t-GOHGlP1to...

THM-Tempest

TryHackMe — Tempest Vía de nivel 1 de SOC | Investigación de respuesta a incidentes Resumen Investigación completa de respuesta a incidentes de una máquina Windows comprometida. El atacante obtuvo acceso inicial a través de un documento malicioso de Word que explotaba CVE-2022-30190 Follina,...

pentest-pivoting

内网穿透指南 目录 1. 重要注意事项 2. SSH 动态端口转发 3. SSH 远程端口转发 4. SSH 本地端口转发 5. 双重 Pivoting 6. sshuttle 7. Chisel 8. 使用 Burpsuite 作为代理 9. 实用资源 重要注意事项 不要使用 ICMP 回显请求（ping）来测试 SOCKS 代理 。 SOCKS 是一种 Internet 协议，通过代理服务器在客户端和服务器之间交换网络数据包。实际上，SOCKS 服务器代理到任意 IP 地址的 TCP 连接，并提供了一种转发 UDP 数据包的方式。你应该使用基于 TCP 的协议来测试它（例如尝试...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: tekton-chains, continuity, containerd, vault-benchmark, flux-kustomize-controller, src-fingerprint, envconsul, crossplane-provider-family-aws, metrics-server, paranoia, terraform-provider-grafana, gitlab-runner, grafana-alloy, golangci-lint,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: tekton-chains, containerd, vault-benchmark, flux-kustomize-controller, tw, crossplane-provider-family-aws, trivy-operator, gitlab-runner, crossplane-provider-aws-cloudformation, docker-machine-driver-linode, k8sgpt, pulumi-language-yaml, gatus,...

GO-2026-5017 vulnerabilities

Vulnerabilities for packages: containerd, trivy-operator, gitlab-runner, pulumi-language-yaml, gatus, prometheus-operator, kubernetes-dashboard, spire-server, scorecard, splunk-otel-collector, pulumi-kubernetes-operator, k3s, kubescape, istio, fscrypt, prometheus, falco-no-driver, zarf, gitea,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: vault-benchmark, flux-kustomize-controller, spegel, src-fingerprint, crossplane-provider-family-aws, paranoia, crossplane-provider-sql, sftpgo-plugin-kms, timescaledb-parallel-copy, gitlab-runner, go-licenses, golangci-lint, crossplane-provider-aws-cloudformation,...

CVE-2026-48113

Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against...

CVE-2026-48113

The CVE-2026-48113 entry concerns Chisel, a TCP/UDP tunnel over SSH, where ACL restrictions provided by --authfile are bypassed on post-handshake SSH channels. Authenticated clients can open channels to arbitrary host:port destinations reachable from the server because ACL checks are performed on...

CVE-2026-48113 Chisel: ACL Bypass via Post-Handshake SSH Channel ExtraData Injection

Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against...

CVE-2026-48113

Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against...

CVE-2026-48113 Chisel: ACL Bypass via Post-Handshake SSH Channel ExtraData Injection

Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: drone-fips, minio, prometheus, opentofu, flux-source-controller-fips, kuma, kubescape, nemo, frankenphp-8.2, gitlab-rails-ce, cilium-cli, k3s, cloudbeat, zot, gitlab-kas, etcd-fips, argo-workflows-fips, minio-fips, prometheus-fips, drone, knative-kafka-broker-fips,...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the Post-Handshake SSH Channel process. An attacker can bypass access control by injecting extra data after the SSH handshake, allowing unauthorized access to restricted resources. Remediation Upgrade...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the Post-Handshake SSH Channel process. An attacker can bypass access control by injecting extra data after the SSH handshake, allowing unauthorized access to restricted resources. Remediation Upgrade...

GO-2026-5054 Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection in github.com/jpillora/chisel

Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection in github.com/jpillora/chisel...

GHSA-24FP-5V3P-RVPW Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection

Summary Authenticated chisel clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against declared remotes, but never on subsequent SSH channels that carry actual traffic. A...