claude-poc

Claude 코드를 악용하는 방법은 여러 가지가 있으며, 이는 제가 연구 중 발견하여 보고한 방법 중 하나입니다 2025년 11월 23일, 수정되지 않음. RT/PT 초기 접근 시 유용하게 사용될 수 있습니다. 요약: apiKeyHelper는 모델 요청에서 X-Api-Key 및 Authorization: Bearer 헤더에 대한 인증 값을 생성하도록 설계된 사용자 정의 셸 스크립트/bin/sh입니다. 그러나 이 스크립트는 시스템 명령을 수락하고 실행하기 때문에, 이 동작은 코드 실행으로 이어집니다 참조. 하지만...

Mystikal

Mystikal macOS 初期アクセスペイロードジェネレーター https://github.com/its-a-feature/Mythic と併用することを想定しています 関連ブログ記事: https://posts.specterops.io/introducing-mystikal-4fbd2f7ae520 使用方法: 1. ビルドマシンに Xcode をインストールします インストーラープラグイン付きインストーラーパッケージに必要 2. python の依存関係をインストールします root@kitploit: sudo pip3 install -r...

Variatype.htb-CVE-2025-66034

Hackthebox Season 10 - Variatype Este script te dará acceso inicial. Primero, instala los módulos requeridos usando pip pip3 install -r requirements.txt Uso python3 exploit.py 'id' o python3 exploit.py 'echo BASE64ENCODEDREVSHELL | base64 -d | bash'...

claude-code-backdoor

Claude Code Backdoor PoC Ein Proof of Concept, der zeigt, wie Claude Code Anthropic's CLI AI agent Hooks für den ersten Zugriff Initial Access und Persistenz genutzt werden können. ⚠️ Haftungsausschluss Dieses Projekt dient ausschließlich zu Bildungs- und ethischen Sicherheitstestzwecken...

ClickOnceBlobber

ClickOnce AppDomainManager Injektions-Toolkit Waffnen Sie signierte .NET ClickOnce-Anwendungen für den Erstzugriff, indem Sie eine Abhängigkeits-DLL per AppDomainManager-Injection kapern und einen C-Port des ProxyBlob-Agenten laden. Enthält einen C-Port von ProxyBlob – einen SOCKS5-Proxy, der den...

CVE-2024-21412_Water-Hydra

CVE-2024-21412Water-Hydra 通过 CVE-2024-21412 传递恶意软件 usage 依次启动服务，并访问 web server webserver 在文件夹内启动 web server: python -m http.server Initial Access: 使用 Windows 高级查询语法（AQS）链接回 WebDAV 共享的 JPEG 木马。 Initial Access：使用 search: 协议来自定义 Windows 资源管理器窗口 它使用 search: 应用协议搜索来执行照片搜索 它使用 crumb 参数来限制搜索范围到恶意的 WebDA...

PackMyPayload

PackMyPayload - Ameaça Emergente de Malware em Contêineres Ir para formatos suportados Esta ferramenta recebe um ficheiro ou diretório como entrada e incorpora-os num ficheiro de saída atuando como um arquivo/contêiner. Pode servir como prova de conceito Proof-of-Concept apresentando o risco...

exchange_webshell_detection

Questo progetto è stato interrotto Utilizza invece gli strumenti Microsoft: Microsoft Safety Scanner Altre rilevazioni e mitigazioni elencate in: https://github.com/microsoft/CSS-Exchange/tree/main/Security Nel valutare l'impatto, suggeriamo vivamente di presumere una compromissione e di esaminar...

Advanced_Initial_access_in_2024_OffensiveX

Questo repository non contiene un README...

CVE-2026-16102

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

PT-2026-68178

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Dynamic Client Registration DCR component of Keycloak. The default DCR policy does not properly validate the claim path for User Property mappers, which enables the...

HTB-Writeups

Hack The Box Writeups This repository contains my Hack The Bo...

Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access

Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin aka Agenda ransomware on victim environments. Arctic Wolf Labs said it investigated multiple intrusions in June 2026 that began with the exploitation o...

CVE-2026-57860 ForgeCode Arbitrary Code Execution via Unvetted .mcp.json in Untrusted Repository

ForgeCode tailcallhq/forgecode, an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and...

EUVD-2026-45217

ForgeCode tailcallhq/forgecode, an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and...

Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images

North Korean threat actors linked to the Contagious Interview campaign have been observed employing steganography in SVG image files to conceal malicious payloads as part of a campaign using fake job postings and coding challenges. "Any user who ran the project ended up with a four-stage payload...

The Gentlemen are knocking: сustom backdoors and evolving tactics

Introduction This year saw the emergence of The Gentlemen, a prominent example of a group operating under the ransomware-as-a-service RaaS model. Although our initial assessment suggested the group first appeared in mid-2025, it actually started ramping up its activities at the beginning of 2026...

New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns

A new, stealthy backdoor named Mistic has been deployed as part of suspected financially motivated attacks aimed at multiple organizations spanning insurance, education, IT, and professional services sectors since April 2026. According to Symantec and Carbon Black's Threat Hunter Team, the...