PackMyPayload

PackMyPayload - 容器化恶意软件的新兴威胁 跳转到支持的格式 该工具接收文件或目录作为输入，并将其嵌入到充当归档/容器的输出文件中。它可作为概念验证，展示容器文件格式与嵌入恶意软件的新兴风险，同时作为专业红队操作员的助手，以优化其初始访问策略。 目前已知威胁行为者通过多种容器文件格式走私恶意软件，例如： 7zip zip ISO IMG 他们这样做是为了让有效载荷绕过文件内容扫描器，但更重要的是避免在其文件上留下“网络标记”标志 。攻击者不希望在其文件上出现 MOTW 的原因有多种：Microsoft Office 中的受保护视图 一直是其中之一。...

claude-poc

Hay múltiples formas de abusar de Claude code, esta es una de ellas que encontré durante mi investigación y reporté 23 de noviembre de 2025 no corregida, podría ser útil al realizar RT/PT para acceso inicial. Resumen: apiKeyHelper es un script de shell personalizado /bin/sh diseñado para generar...

claude-code-backdoor

Claude Code Puerta Trasera PoC Una Prueba de Concepto que demuestra cómo los hooks de Claude Code el agente AI de CLI de Anthropic pueden ser aprovechados para Acceso Inicial y Persistencia. ⚠️ Aviso legal Este proyecto es únicamente para fines educativos y de pruebas de seguridad ética. El acceso...

ClickOnceBlobber

Kit de Inyección AppDomainManager para ClickOnce Armar aplicaciones .NET ClickOnce firmadas para acceso inicial mediante el secuestro de una DLL dependiente a través de inyección AppDomainManager y la carga de un puerto C del Agente ProxyBlob. Incluye un puerto C de ProxyBlob — un proxy SOCKS5 qu...

CVE-2024-21412_Water-Hydra

CVE-2024-21412Water-Hydra Distribución de malware a través de CVE-2024-21412 usage Iniciar los servicios en orden y acceder al servidor web webserver Iniciar un servidor web dentro de la carpeta: python -m http.server Initial Access: Uso de la sintaxis de consulta avanzada de Windows AQS para...

Variatype.htb-CVE-2025-66034

Hackthebox Season 10 - Variatype Este script te dará acceso inicial. Primero, instala los módulos requeridos usando pip pip3 install -r requirements.txt Uso python3 exploit.py 'id' o python3 exploit.py 'echo BASE64ENCODEDREVSHELL | base64 -d | bash'...

Mystikal

Mystikal Generador de payloads de acceso inicial para macOS Diseñado para usarse con https://github.com/its-a-feature/Mythic Publicación de blog relacionada: https://posts.specterops.io/introducing-mystikal-4fbd2f7ae520 Uso: 1. Instala Xcode en la máquina de compilación requerido para el paquete ...

Advanced_Initial_access_in_2024_OffensiveX

Este repositorio no tiene un README...

exchange_webshell_detection

Este proyecto ha sido descontinuado Por favor, use las herramientas de Microsoft en su lugar: Microsoft Safety Scanner Otras detecciones y mitigaciones listadas en: https://github.com/microsoft/CSS-Exchange/tree/main/Security Al evaluar el impacto, sugerimos encarecidamente asumir una brecha y...

EUVD-2026-72540

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...

BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory

Cybersecurity researchers have disclosed details of a sophisticated Python-based Windows malware framework called BraZetsu that fuels an underground marketplace commercializing access to compromised hosts. "Unlike the standard infostealer model, BraZetsu is a comprehensive master toolkit that...

Threat Actors Don’t Want Better Attacks. They Want Repeatable Ones

The most common way into a company last year was to ask. A web page tells the visitor to prove they are not a robot. While they read the instructions, it quietly places a command on their clipboard. Then it talks them through opening a terminal and pasting it in. The technique is called ClickFix,...

CVE-2026-16102

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

PT-2026-68178

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Dynamic Client Registration DCR component of Keycloak. The default DCR policy does not properly validate the claim path for User Property mappers, which enables the...

HTB-Writeups

Hack The Box Writeups This repository contains my Hack The Bo...

Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access

Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin aka Agenda ransomware on victim environments. Arctic Wolf Labs said it investigated multiple intrusions in June 2026 that began with the exploitation o...

CVE-2026-57860 ForgeCode Arbitrary Code Execution via Unvetted .mcp.json in Untrusted Repository

ForgeCode tailcallhq/forgecode, an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and...

EUVD-2026-45217

ForgeCode tailcallhq/forgecode, an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and...