wsuks

wsuks 自动化 WSUS 攻击 获取已加入域 Windows 计算机的本地管理员访问权限通常是渗透测试的第一步。在许多情况下，Windows 服务器更新服务（WSUS）被配置为通过 HTTP 在本地网络上向客户端部署更新。由于没有 HTTPS 的安全保护，攻击者可以发起中间人攻击，为客户端提供一个更新，该更新随后将以 SYSTEM 权限执行。任何 Microsoft 签名的可执行文件都可以作为更新提供，包括一条用于执行该可执行文件的自定义命令。如果攻击者能够获得 WSUS 服务器的 TLS 证书，则此技术也可以通过 HTTPS 执行（参见 ESC17 和我们的博客文章）。 为了自动利...

MiscTools

MiscTools CsExec 命令执行 / 通过类似 PsExec 的功能进行横向移动。必须以特权用户身份运行。 CsExec.exe 另请参阅 TikiService。 CsPosh 命令执行 / 通过 PowerShell 进行横向移动。在远程目标上创建 PowerShell 运行空间。必须以特权用户身份运行。 Usage: -t, --target=VALUE Target machine -c, --code=VALUE Code to execute -e, --encoded Indicates that provided code is base64 encoded -...

ranger

ranger A tool to support security professionals access and interact with remote Microsoft Windows based systems. This project was conceptualized with the thought process, we did not invent the bow or the arrow, just a more efficient way of using it. Ranger is a command-line driven attack and...

elevationstation

Elevation Station Stealing and Duplicating SYSTEM tokens for fun & profit! We duplicate things, make twin copies, and then ride away. You have used Metasploit's getsystem and SysInternals PSEXEC for getting system privs, correct? Well, here's a similar standalone version of that...but without the...

smbexec

smbexec 使用 Samba 工具快速执行 psexec 风格攻击 原始概念和脚本由 Brav0Hax 和 PureHate 编写 移植至 Ruby 并由 Smilingraccoon 和 Zeknox 修改 代号 - 马基雅维利 编写原因：我们厌倦了 Metasploit PSExec 被触发的情况 特别感谢 Carnal0wnage，他的博客启发我们选择了这条路径。 http://carnal0wnage.attackresearch.com/2012/01/psexec-fail-upload-and-exec-instead.html v2.0 - 2013/10/17 更新...

CheeseTools

CheeseTools このリポジトリは、既存のMiscTool1をベースに作成されています。rasta-mouse氏がツールを公開し、それに取り組む動機を与えてくれたことに大いに感謝します。 CheeseExec PsExecのような機能によるコマンド実行/横移動。特権ユーザーのコンテキストで実行する必要があります。 このツールはrasta-mouseのCsExecをベースにしていますが、サービスの作成において追加の制御を可能にするように設計されています。具体的には: Create サービスが存在するか確認し、存在しなければ作成を試みる Start...

dfirtriage

dfirtriage Digital forensic acquisition tool for Windows-based incident response. How to Use To run, drop dfirtriage.exe on the target or connected USB drive and execute with admin rights, -h for help. DFIRTriage v6.0 User's Manual Description This document outlines the functionality and proper u...

psexec_noinstall

psexecnoinstall 该仓库包含 psexec，它将帮助你利用被遗忘的管道 让一个非天才管理员使用 PsExec 连接到主机： 当我们看到 RemComCommunication 捆绑包时发现了这一点。这是 PsExec 的标准配置 使用 psexecnoinstall，可以以任何低权限用户身份连接到该管道，因为管道的 DACL 允许这样做： 这里有一个检查器： https://github.com/beaverdreamer/nxc-modules...

Modules

模块 Havoc Framework 所使用的模块。 Powerpick Havoc Framework 的 Powerpick 实现。 InvokeAssembly Havoc Framework 的 InvokeAssembly 实现。 Template 这是模块的基础模板。你可以使用它来为 Havoc Framework 编写自己的模块。 SituationalAwareness 一组态势感知 beacon 对象文件。来自 Situational Awareness BOF RemoteOps 一组远程操作 beacon 对象文件。来自 Remote Operations BOF...

Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access

Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin aka Agenda ransomware on victim environments. Arctic Wolf Labs said it investigated multiple intrusions in June 2026 that began with the exploitation o...

Weekly Metasploit Update: Modules for SMB-to-Meterpreter, Peyara Remote Mouse RCE exploit, and more

It's Time to Upgrade Your SMB Session This week, Metasploit contributor Dean Welch has added an SMB to Meterpreter session upgrade module. It uses PsExec to facilitate the upgrade. Users can load the module with use windows/manage/smbtometerpreter and specify the session number they wish to...

SMB to Meterpreter Upgrade via PsExec

Upgrades an authenticated SMB session to a Meterpreter session using PsExec techniques. This module uploads a service-wrapped executable payload to the ADMIN$ share via the existing authenticated SMB connection, then creates and starts a Windows service that executes the payload. This mirrors the...

EUVD-2021-7197

Malicious code in bioql PyPI...

Retail at risk: How one alert uncovered a persistent cyberthreat​​

In the latest edition of our Cyberattack Series, we dive into real-world cases targeting retail organizations. With 60% of retail companies reporting operational disruptions from cyberattacks and 43% experiencing security compromises in the past year, the risks for businesses continue to increase...

📄 Microsoft AutoUpdate Privilege Escalation

Microsoft AutoUpdate MAU suffers from a privilege escalation vulnerability. Titles: CVE-2025-47968-Core-Logic Microsoft AutoUpdate MAU Elevation of Privilege Vulnerability Author: nu11secur1ty Date: 07/03/2025 Vendor: https://www.microsoft.com/en-us Software:...

Hacktivist Group Twelve Targets Russian Entities with Destructive Cyber Attacks

A hacktivist group known as Twelve has been observed using an arsenal of publicly available tools to conduct destructive cyber attacks against Russian targets. "Rather than demand a ransom for decrypting data, Twelve prefers to encrypt victims' data and then destroy their infrastructure with a...

New Ransomware Group Exploiting Veeam Backup Software Vulnerability

A now-patched security flaw in Veeam Backup & Replication software is being exploited by a nascent ransomware operation known as EstateRansomware. Singapore-headquartered Group-IB, which discovered the threat actor in early April 2024, said the modus operandi involved the exploitation of...

ToddyCat is making holes in your infrastructure

We continue covering the activities of the APT group ToddyCat. In our previous article, we described tools for collecting and exfiltrating files LoFiSe and PcExter. This time, we have investigated how attackers obtain constant access to compromised infrastructure, what information on the hosts th...

Using the LockBit builder to generate targeted ransomware

The previous Kaspersky research focused on a detailed analysis of the LockBit 3.0 builder leaked in 2022. Since then, attackers have been able to generate customized versions of the threat according to their needs. This opens up numerous possibilities for malicious actors to make their attacks mo...

Kasseika Ransomware Using BYOVD Trick to Disarms Security Pre-Encryption

The ransomware group known as Kasseika has become the latest to leverage the Bring Your Own Vulnerable Driver BYOVD attack to disarm security-related processes on compromised Windows hosts, joining the likes of other groups like Akira, AvosLocker, BlackByte, and RobbinHood. The tactic allows...