NamedPipePTH

NamedPipePTH 该项目是一个概念验证代码，用于在本地命名管道用户模拟中使用传递哈希（Pass-the-Hash）进行身份验证。另有一篇博客文章进行解释： https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/ 它基于项目 Invoke-SMBExec.ps1 和 RoguePotato 的代码实现。 过去我曾在某些 Offensive Security 项目中遇到这样的情况：我已经拥有一个 低权限 用户账户的 NTLM 哈希，需要在该用户账户下获取当前已沦陷系统的 shell——但现有的公共工具无法实现。假设这种情况还面临两个事实：NT...

outis

outis outis 是一款自定义远程管理工具（RAT）或类似的东西。可以把它想象成 Meterpreter 或 Empire-Agent。然而，这款工具的重点既不是利用工具包（它不包含任何漏洞利用程序），也不是对目标的持久管理。其核心在于通过各种方法和平台在服务器与目标系统之间进行通信，以及传输文件、共享套接字、生成 Shell 等。 关于名称 荷马史诗《奥德赛》中的独眼巨人波吕斐摩斯在名字解析方面遇到了一些问题。当他询问奥德修斯的名字时，这位黑客告诉他，自己的名字是“Outis”，在古希腊语中意为“没有人”。因此，当波吕斐摩斯后来大喊“没有人”要杀死他时，奇怪的是没有任何救援到来。...

egressbuster

EgressBuster 版权 2015 TrustedSec - EgressBuster 作者: David Kennedy ReL1K 公司: TrustedSec 免责声明：仅用于测试目的，且只能在获得明确同意的情况下使用。不得将其用于非法目的。 请阅读EgressBuster的许可协议。 功能 EgressBuster是一种测试特定区域出口过滤效果的方法。在进行渗透测试时，公司经常使用出口过滤来阻止访问外部互联网。大多数公司有特殊的例外情况并允许某些端口，但这些端口可能难以发现。 EgressBuster有两个组件： egressbuster -...

Malicious code in ts-eslint-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e1ffed26d2d64bf9076210504de22b87e27a065821dedbc708fb05f7c47db74 The package [email protected] presents as a TypeScript/ESLint/Jest helper but ships lib/collect.js, which imports childprocess and invokes...

ASKEY RTF3505VW-N1 - Privilege Escalation Exploit

Exploit Title: ASKEY RTF3505VW-N1 - Privilege escalation Exploit Author: Leonardo Nicolas Servalli Vendor Homepage: www.askey.com Platform: ASKEY router devices RTF3505VW-N1 Tested on: Firmware BRSVg000R3505VMN1001s327 Vulnerability analysis:...

Command Injection

@graphql-tools/git-loader is vulnerable to command injection. The vulnerability exist due to the usage of exec and execSync which allows the spawning of a shell...

Hack-Tools v0.3.0 - The All-In-One Red Team Extension For Web Pentester

The all-in-oneRed Team browser extension for Web Pentesters HackTools, is a web extension facilitating your web application penetration tests , it includes cheat sheets as well as all the tools used during a test such as XSS payloads, Reverse shells and much more. With the extension you no longer...

Ajenti 2.1.31 Command Injection Exploit

This Metasploit module exploits a command injection in Ajenti version 2.1.31. By injecting a command into the username POST parameter to api/core/auth, a shell can be spawned. This module requires Metasploit: https://metasploit.com/download Current source:...

Ajenti auth username Command Injection

This module exploits a command injection in Ajenti == 2.1.31. By injecting a command into the username POST parameter to api/core/auth, a shell can be spawned. Module Options msf use exploit/unix/webapp/ajenti/authusernamecmdinjection msf undefinedauthusernamecmdinjection show actions ...actions...

Mandrake 7.0/7.1,RedHat Kon2 0.3.9 fld Input File Overflow

No description provided by source. source: http://www.securityfocus.com/bid/1371/info KON Kanji On Console is a package for displaying Kanji text under Linux and comes with two suid binaries which are vulnerable to buffer overflows. fld, one of the vulnerable programs, accepts options input from ...

Symantec Altiris DS - SQL Injection (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Symantec Altiris ...

linux/x86 setuid(0) && execve(/bin/sh,0,0) 27 bytes

Exploit for linux/x86 platform in category shellcode ============================================================= linux/x86 setuid0 && execve/bin/sh,0,0 shellcode 27 bytes ============================================================= Special Thanks Inj3ct0r Exploit DataBase I Love Inj3ct0r.Com...

thinkedit-rfi.txt

r0ut3r Presents... Another r0ut3r discovery! writ3r at gmail.com ThinkEdit Remote File Inclusion Exploit Software: ThinkEdit 1.9.2 Vendor: http://www.thinkedit.org/ Released: 2006/12/08 Discovered & Exploit By: r0ut3r writ3r at gmail.com Note: The information provided in this document is for...

GFHost PHP GMail - Remote Command Execution

GFHost PHP GMail - Remote Command Execution GFHost explo Spawn bash style Shell with webserver uid Greetz SPAX, foxtwo, Zone-H This Script is currently under development use strict; use IO::Socket; my $host; my $port; my $command; my $url; my @results; my $probe; my @U; $U1 =...

ProFTPd 1.2.7 1.2.9rc2 - Remote Code Execution Brute Force

ProFTPd 1.2.7 1.2.9rc2 - Remote Code Execution Brute Force / ProFTPd 1.2.7 - 1.2.9rc2 remote r00t exploit -------------------------------------------- By Haggis This exploit builds on the work of bkbll to create a working, brute-force remote exploit for the \n procesing bug in ProFTPd. Tested on...

Microsoft Windows - WebDAV Remote Code Execution (2)

Microsoft Windows - WebDAV Remote Code Execution 2 // / 29/05/2003 - by Alumni - / / Microsoft IIS WebDAV New Exploit / / spawns shell on port 32768 / // include include include define SHELLCODELEN 753 define NOP 0x90 define BUFFERLEN 1024 define RET 0x41424344 define GMHOFF 30 define GPAOFF 38...

Microsoft Windows - WebDAV Remote Code Execution (2)

// / 29/05/2003 - by Alumni - / / Microsoft IIS WebDAV New Exploit / / spawns shell on port 32768 / // include include include define SHELLCODELEN 753 define NOP 0x90 define BUFFERLEN 1024 define RET 0x41424344 define GMHOFF 30 define GPAOFF 38 define IPOFF 161 define DEFPORT 32768 //define...

HP-UX 10.20/11.0 - crontab '/tmp' File

source: https://www.securityfocus.com/bid/1845/info crontab is a binary in the cron package of the HP-UX cron implementation which allows a user to create a file of scheduled commands. A vulnerabiltiy in crontab exists that allows a user to read any file on an HP-UX system. crontab as implemented...