moonwalk

moonwalk 在Linux漏洞利用/渗透测试期间掩盖你的踪迹，在系统日志和文件系统时间戳上不留任何痕迹。 📖 目录 简介 功能 安装 使用方法 贡献 许可证 ℹ️ 简介 moonwalk 是一个 400 KB 的单二进制可执行文件，能够在渗透测试 Unix 机器时清除你的痕迹。它可以保存渗透前系统日志的状态，并在渗透后恢复该状态，包括文件系统时间戳，从而在 shell 中不留一丝 "幽灵" 的痕迹。 ⚠️ 注意： 本工具开源仅供 红队 操作使用，作者对任何因不当使用该工具所造成的后果概不负责。请仅在已获授权的机器上使用。 功能 小型可执行文件： 通过 curl 快速下载到目标机器。...

cve-2021-34527

CVE-2021-34527 Exploit de LPE para CVE-2021-34527 mediante AddPrinterDriverEx - esta es una versión armada del LPE que puede emplearse para escalar una DLL a SYSTEM y que también limpiará los artefactos. El LPE afecta a Windows Desktop 7,8,8.1,10,11 y Server 2008,2012,2016,2019. Este proyecto de...

PersistAssist

PersistAssist PersistAssist 是一个完全模块化的持久化框架，使用 C 编写。所有持久化技术都包含一个清理方法，用于在持久化代码之外移除持久化。这是一个正在进行中的项目，因此有许多空类。此项目最初的主要目标是构建一个完全模块化的框架，使得添加新功能只需继承一个类并添加代码即可。 作者 - Victor Suarez（@Gr1mmie） 编译 PersistAssist 不会提供预编译的二进制文件，因此您需要手动编译代码。要完成此操作，请打开解决方案文件，在构建菜单中选择“Release”以及所需架构，然后点击开始。 使用 要查看帮助菜单，请使用...

Secure-Desktop

Secure-Desktop Secure Desktop es una herramienta para Windows que permite abrir programas en un área segura a la que los keyloggers y las herramientas de administración remota no pueden acceder por ningún medio convencional. Los keyloggers de software funcionan instalando un gancho de Windows que...

CVE-2026-23918

CVE-2026-23918 Doble liberación en la limpieza de flujos de modhttp2 de Apache httpd que conduce a una ejecución remota de código RCE sin autenticación. Afectado: httpd 2.4.66 con modhttp2 y MPM de múltiples subprocesos event/worker. Corregido en: 2.4.67. Encontrado y reportado por Bartlomiej...

CVE-2025-21420-PoC

CVE-2025-21420 PoC Vulnerabilidad de Elevación de Privilegios en la Herramienta de Liberación de Espacio en Disco de Windows Hasta donde sé, aunque incompleto, este es el primer PoC para esta CVE. https://nvd.nist.gov/vuln/detail/CVE-2025-21420 https://vulners.com/cve/CVE-2025-21420 Encontramos u...

Ledger

Ledger — Script agresor de seguimiento de cambios operativos Ledger es un script agresor de Cobalt Strike que registra cada cambio operativo realizado durante un compromiso. Cada servicio que habilitas, regla de firewall que abres, cuenta que creas o clave de registro que tocas queda registrada c...

CVE-2026-106394

Incomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106375

Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106243

Incomplete cleanup in Proxy Auth in Google Chrome prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. Chromium security severity: High...

CVE-2026-106366

Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-105865

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload...

CVE-2026-105865 Payload: Incomplete validation during the upload file lifecycle

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload...

CVE-2026-105865

The Payload headless content management system is vulnerable to a path traversal issue in versions before 3.90.0 and canary versions before 4.0.0-canary.34 . An authenticated user with permissions to update or delete locally stored uploads can trigger a file cleanup process that removes unintende...

EUVD-2026-93511

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload...

azazel

Azazel V 0.1 The whole earth has been corrupted through the works that were taught by Azazel: to him ascribe all sin. -- 1 Enoch 2:8 Azazel is a userland rootkit based off of the original LDPRELOAD technique from Jynx rootkit. It is more robust and has additional features, and focuses heavily...

Stable Channel Update for Desktop

The Stable channel has been updated to 155.0.8059.39/.40 for Windows and Mac and 155.0.8059.39 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log Security Fixes and Rewards Note: Access to bug details and links may be kept...

PT-2026-106736

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's...

CVE-2026-93315

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build...

CVE-2026-93315

The BuildKit build engine is vulnerable to a Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) when using proxy networking with CA injection. A build step can modify the CA bundle before the cleanup process occurs, potentially causing the cleanup to block, execute outside the build root...