wsuks

wsuks WSUS 공격 자동화 도메인에 가입된 Windows 머신에 대한 로컬 관리자 액세스를 획득하는 것은 일반적으로 침투 테스트의 첫 단계입니다. 많은 경우 Windows Server Update ServiceWSUS가 HTTP를 통해 로컬 네트워크의 클라이언트에 업데이트를 배포하도록 구성되어 있습니다. HTTPS의 보안이 없다면 공격자는 중간자 공격을 수행하여 클라이언트에 업데이트를 제공할 수 있으며, 이 업데이트는 SYSTEM 권한으로 실행됩니다. Microsoft 서명된 실행 파일은 업데이트로 제공될 수 있으며, 실...

CredNinja

Этот инструмент предназначен для пентестеров, которые хотят быстро и эффективно провести тестирование на проникновение. Хотя этот инструмент можно использовать для более скрытных операций включая некоторые дополнения ниже, он действительно раскрывается в масштабе крупной сети. В основе его...

SharpRelay

Использование Единственное требование для работы этой атаки — наличие бикона с правами локального администратора или возможность загружать драйверы. Атака с использованием SharpRelay работает следующим образом: Загрузите подписанный драйвер WinDivert в любую папку на скомпрометированном хосте...

KSLDBYOVDARK

KSLDBYOVD Ссылка: KslKatz и KslDump. KslD.sys, также известный как MpKslDrv.sys, ранее был одним из драйверов средств защиты от руткитов Microsoft Antimalware сюда входят Microsoft Defender Antivirus, Windows Defender Antivirus в старых версиях Windows, Microsoft Security Essentials, System Cente...

Check-LocalAdminHash

Check-LocalAdminHash Check-LocalAdminHash — это инструмент PowerShell, который пытается аутентифицироваться на нескольких хостах через WMI или SMB, используя хэш пароля, чтобы определить, является ли предоставленная учетная запись локальным администратором. Это полезно, если вы получили хэш парол...

automato

automato.rb automato uses native LDAP libraries to automate the collection and enumeration of various directory objects. This is incredibly useful during an internal penetration test. automato can also conduct password spraying attacks, and identify if a user is a local administrator against any...

LACheck

LACheck Многопоточная сборка C .NET для перечисления локальных административных привилегий Аргументы root@kitploit: ./LACheck.exe help | | /\ / | | | | | | / \ | | | | | | | | / /\ \ | | | ' \ / / | |/ / | | / \ | || | | | / | |// \ || |||||\ Использование: LACheck.exe smb rpc...

CVE-2025-26686-The-TCP-IP-Flaw-That-Opens-the-Gates

CVE-2025-26686-문을-여는-TCP-IP-결함 Windows TCP/IP 스택의 치명적인 RCE 취약점CVE-2025-26686이 민감한 메모리 잠금 해제를 방치하여 원격 공격자가 시스템을 탈취할 수 있습니다. 네트워크를 통해 악용 가능하며, 완전한 장악 위험이 있습니다. 지금 패치하세요. 작성자: Mark Mallia 유형: 원격 코드 실행 RCE 심각도: 심각 공격 벡터: 네트워크 기반 영향을 받는 시스템: Windows 10, 11 및 Server 에디션 요약 Microsoft TCP/IP 스택에서...

SharpGPOAbuse

SharpGPOAbuse SharpGPOAbuse — это .NET-приложение на C, которое позволяет использовать права пользователя на редактирование объекта групповой политики GPO для компрометации объектов, управляемых этой политикой. Подробнее можно узнать в следующей записи блога:...

RedSun-

RedSun Red Sun 취약점 저장소 평소 같으면 PoC 코드만 던져두고 사람들이 알아서 파악하게 했을 겁니다. 하지만 이번 건은 그럴 수가 없네요. 너무 웃기거든요. Windows Defender가 악성 파일에 클라우드 태그가 있다는 것을 알게 되면, 어처구니없고도 우스운 이유로, 보호를 담당해야 할 안티바이러스가 발견한 파일을 다시 원래 위치에 덮어쓰는 것이 좋은 생각이라고 판단합니다. PoC는 이 동작을 악용하여 시스템 파일을 덮어쓰고 관리자 권한을 획득합니다. 안티멀웨어 제품은 악성 파일을 제거해야 하는 것이지, 파...

CVE-2026-90039

In the Linux kernel, the following vulnerability has been resolved: NFSD: Guard admin state-revocation walks with NFSDNETUP Writing to /proc/fs/nfsd/unlockfilesystem, or sending the NFSDCMDUNLOCKFILESYSTEM or NFSDCMDUNLOCKEXPORT netlink command, walks the NFSv4 client hash tables to revoke open...

CVE-2026-90039 NFSD: Guard admin state-revocation walks with NFSD_NET_UP

In the Linux kernel, the following vulnerability has been resolved: NFSD: Guard admin state-revocation walks with NFSDNETUP Writing to /proc/fs/nfsd/unlockfilesystem, or sending the NFSDCMDUNLOCKFILESYSTEM or NFSDCMDUNLOCKEXPORT netlink command, walks the NFSv4 client hash tables to revoke open...

EUVD-2026-80647

In the Linux kernel, the following vulnerability has been resolved: NFSD: Guard admin state-revocation walks with NFSDNETUP Writing to /proc/fs/nfsd/unlockfilesystem, or sending the NFSDCMDUNLOCKFILESYSTEM or NFSDCMDUNLOCKEXPORT netlink command, walks the NFSv4 client hash tables to revoke open...

CVE-2026-73465

On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already...

CVE-2026-73466

On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess...

EUVD-2026-79024

On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess...

CVE-2026-73465

CVE-2026-73465 is a CWE-532 (Insertion of Sensitive Information into Log File) vulnerability in Arista EOS . When MgmtSecuritySslCertKey trace levels 0, 3, and/or 4 are enabled on the ConfigAgent agent, plaintext RSA and EC private keys may be written to /var/log/agents/ConfigAgent-* log files. E...

EUVD-2026-79023

On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already...

CVE-2026-73465 On affected platforms running Arista EOS, under certain circumstances plaintext private keys

On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already...

CVE-2026-89547

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svccreate initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit fails when allocpercpugfp cannot satisfy the allocation, leaving...