pyradm

🔮 pyradm 通过Telegram进行远程管理的跨平台工具 使用 ❤️ python3 + aiogram3 编写 https://t.me/whlab 截图 免责声明 本仓库中的所有信息仅供教育和研究目的使用 作者对任何非法使用本工具的行为不承担责任 💻 v0.4 - 新增Windows凭据恢复 远程截图 跨平台 高性能（异步I/O） 上传/下载 完全兼容的Shell 进程列表 摄像头（视频录制或截图） 地理位置 文件管理器 麦克风 剪贴板（文本、图像） Windows凭据恢复（浏览器、数据库、聊天、邮件等） Linux凭据恢复 WiFi密码恢复 🔗 非常感谢 LaZagne 项目...

swap_digger

swapdigger swapdigger 是一个 Bash 脚本，用于在渗透测试后期或取证分析中自动进行 Linux 交换分区分析。它能自动提取交换分区内容，并搜索 Linux 用户凭证、Web 表单凭证、Web 表单邮箱、HTTP 基本认证、WiFi SSID 及密钥等信息。 下载并运行工具 在本地机器上 使用以下命令下载并在本地机器上运行脚本： root@kitploit: git clone https://github.com/sevagas/swapdigger.git cd swapdigger chmod +x swapdigger.sh sudo...

CVE-2026-77975

Ebyte NE2-D11 (also affecting the NA111-M model) contains a cleartext storage of sensitive information vulnerability. The device exports administrative credentials and other sensitive configuration data without adequate protection. An unauthenticated attacker on the adjacent network who obtains a...

linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module

A flaw was found in Linux-PAM's pamuserdb module. This vulnerability, categorized as an Observable Timing Discrepancy CWE-208, allows a local or network-adjacent attacker to recover plaintext passwords. By repeatedly attempting authentication and measuring response-timing differences during...

linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module

A flaw was found in Linux-PAM's pamuserdb module. This vulnerability, categorized as an Observable Timing Discrepancy CWE-208, allows a local or network-adjacent attacker to recover plaintext passwords. By repeatedly attempting authentication and measuring response-timing differences during...

CVE-2017-9476

CVE-2017-9476 AP nascosto con credenziali deterministiche. Compilazione root@kitploit: cc xhscmmac2psk.c -o xhscmmac2psk Utilizzo root@kitploit: ./xhscmmac2psk L'algoritmo è stato anche aggiunto a PSKracker. Riferimenti CVE-2017-9476 Bastille-18.home-security-wifi-network.txt whitepaper del DEFCO...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099440)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099440 advisory. Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. Th...

CVE-2026-55765 CloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database pod

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and...

Unity Linux 20.1070a Security Update: libpq (UTSA-2026-099554)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099554 advisory. Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. Th...

CVE-2026-47234 Admidio writes session IDs and auto-login cookie values to application logs

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, Session::setCookie logs full cookie values and Session::start logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent...

CVE-2026-18691

An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to ...

EUVD-2026-56921

An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to ...

CVE-2026-6727

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys,...

CVE-2025-15631

A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized acces...

EUVD-2025-210613

A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized acces...

CVE-2025-15631 Weak Credential Storage in TP-Link Omada Devices

A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized acces...

CVE-2025-15631

CVE-2025-15631 describes a cryptographic weakness in TP-Link Omada devices where site credentials are protected with a legacy hashing algorithm that does not provide sufficient protection. The affected component is credential storage on Omada devices; the root cause is the use of an inadequate ha...

CVE-2025-15544 Weak Credential Protection During TP-Link Omada Device Adoption

A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related...

postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison

A flaw was found in PostgreSQL. This vulnerability, a covert timing channel, exists in the comparison of MD5-hashed passwords during authentication. A remote attacker could exploit this to recover user credentials, gaining unauthorized access to the database. This issue specifically impacts...

PT-2026-67462

A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized acces...