288 matches found
PULSE-C2
PULSE C2 フレームワーク HTTPS コマンド＆コントロールインフラストラクチャ。Webダッシュボードを備え、リモートのWindowsエージェントを管理します。 ⚠️ 教育目的のみ - 不正使用は自己責任です。 特徴 HTTPS C2サーバー（TLS暗号化、Flask） リアルタイムWebダッシュボード XOR + Base64暗号化プロトコル 永続ストレージ用SQLiteデータベース リモートシェル、ファイル流出、ビーコン制御 デバッグ出力なしのサイレントエージェント クイックスタート サーバー: root@kitploit: cd server pip install...
CVE-2021-43326_Exploit
CVE-2021-43326 エクスプロイト Automox Windows Agent 権限昇格エクスプロイト Lacework Labs Blog Post https://www.lacework.com/blog/cve-2021-43326/ Automox Community Post https://community.automox.com/product-updates-4/cve-2021-43326-and-cve-2021-43325-local-privilege-escalation-in-automox-agent-windows-only-1636...
racketeer
Racketeer 프로젝트 - 랜섬웨어 시뮬레이션 툴킷 이 프로젝트의 목표는 팀이 회사 자산 및 네트워크 엔드포인트 집합에 대해 통제된 방식으로 일반적인 랜섬웨어 작동을 시뮬레이션하고 탐지 능력을 테스트할 수 있는 방법을 제공하는 것입니다. 배포 모델 Racketeer 툴킷은 에이전트/베이스 모델로 작동하며 현재 에이전트 수준에서 Windows OS 시스템을 지원하고, 명령 및 제어 베이스는 크로스 플랫폼입니다. 아키텍처 다이어그램 아키텍처 참조 더 읽기: 에이전트 베이스 운영 보안 OpSec 참조 유틸리티 유틸리티 참조...
CVE-2024-0670
CVE-2024-0670 – CheckMK Agent のローカル特権昇格（PowerShell PoC） 概要 このリポジトリは、CheckMK Agent における Windows のローカル特権昇格の脆弱性である CVE-2024-0670 に対する独立した PowerShell 概念実証（PoC）を提供します。この脆弱性により、低権限のローカルユーザーが MSI 修復プロセス中の予測可能なコマンドファイル実行を悪用して、NT AUTHORITY\SYSTEM へ特権昇格できる可能性があります。 この実装は、elsevar11 氏による公開...
CVE-2024-0670-CheckMK-Agent-Local-Privilege-Escalation-Exploit
CVE-2024-0670 – CheckMK Agent ローカル特権昇格 PoC このリポジトリには、CVE-2024-0670（CheckMK Windows Agent のローカル特権昇格の脆弱性）のシンプルでクリーンな概念実証が含まれています。 低権限のユーザーが、MSI修復中に実行される書き込み可能な一時ファイルパスを悪用することで、SYSTEM権限を取得できます。 🔍 脆弱性の概要 ベンダー: Tribe29 CVE: CVE-2024-0670 アドバイザリ:...
CVE-2024-9950-PoC
CVE-2024-9950-PoC Forescout SecureConnector = 11.3.07 詳細 私のブログ 情報 脆弱性: セキュリティ設定が不十分なディレクトリでの一時スクリプトの作成 深刻度: 中～高 ベクター: ローカルWindows OSマシン 攻撃の複雑さ: 低 必要な権限: 低 カテゴリ: ローカル権限昇格 アプリケーション 影響を受けるコンポーネント: Windowsエージェント - Forescout eyeSightおよびeyeControlのSecureConnector 影響を受けるバージョン: Forescout SecureConnector ...
Kaseya VSA < 9.5.7 - Credential Disclosure via Windows Agent
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client...
CVE-2026-40106 Wazuh: Heap-based Buffer Overflow in syscheck Registry Wildcard Expansion (LPE / DoS)
Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.6.0 and above prior to 4.14.5 contain a heap-based buffer overflow vulnerability in the syscheck component of the Wazuh agent for Windows. When expanding registry paths containing wildcards or...
MAL-2026-10756 Malicious code in darkglitch (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a84fec55fc625d5e2b337aafe5a9a95ff30c47403241c59dbb33543ec97311a The package installs a listener CLI darkglitch -l -b that opens a WebSocket to the hardcoded signaling host malware-signal.vercel.app and joins the...
PT-2026-60610
Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.6.0 and above prior to 4.14.5 contain a heap-based buffer overflow vulnerability in the syscheck component of the Wazuh agent for Windows. When expanding registry paths containing wildcards or...
Vulnerabilities exist in several Fortinet products
Fortinet has identified vulnerabilities in several versions of FortiSIEM Windows Agent and general product versions, FortiOS, FortiPAM, and FortiProxy. One vulnerability exists in the FortiSIEM Windows Agent versions 7.4.0 through 7.4.1 with the identifier CVE-2026-59841. This vulnerability allow...
CVE-2026-59841
Technical details for CVE-2026-59841 are not publicly available in the provided documents. Monitor Fortinet advisories and NVD/CVE records for updates on affected product/version, impact, and fixes.
Malicious code in logger-daemon-regex (npm)
The npm package logger-daemon-regex is a full-spectrum information stealer and remote-control agent disguised as a "Node.js integration layer for Autodesk Forge" all bin names are forge-. A postinstall lifecycle hook chains five scripts postinstall-clipboard-event, ensure-dist,...
Veeam Backup and Replication < 13.0.2.29 (kb4852)
The version of Veeam Backup and Replication installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the kb4852 advisory. - A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on...
CVE-2024-47091 Privilege escalation via mk_mysql agent plugin on Windows
Privilege escalation in the mkmysql agent plugin on Windows in Checkmk 2.4.0p29, 2.3.0p47, and 2.2.0 EOL allows a local unprivileged user able to create a Windows service whose name matches 'MySQL' or 'MariaDB' or with write access to a binary referenced by such a service to execute arbitrary cod...
PT-2026-40585
Privilege escalation in the mk mysql agent plugin on Windows in Checkmk 2.4.0p29, 2.3.0p47, and 2.2.0 EOL allows a local unprivileged user able to create a Windows service whose name matches 'MySQL' or 'MariaDB' or with write access to a binary referenced by such a service to execute arbitrary co...
GHSA-FC67-C4HG-Q653 Amazon ECS Container Agent (Windows) is vulnerable to Information Disclosure
Summary Amazon Elastic Container Service Amazon ECS is a fully managed container orchestration service that enables customers to deploy, manage, and scale containerized applications. An issue exists where, under certain circumstances, improper input validation in the FSx Windows File Server volum...
Amazon ECS Container Agent (Windows) is vulnerable to Information Disclosure
Summary Amazon Elastic Container Service Amazon ECS is a fully managed container orchestration service that enables customers to deploy, manage, and scale containerized applications. An issue exists where, under certain circumstances, improper input validation in the FSx Windows File Server volum...
CVE-2026-2123 Privilege escalation vulnerability in Operations Agent
A security audit identified a privilege escalation vulnerability in Operations Agent=OA 12.29 on Windows. Under specific conditions Operations Agent may run executables from specific writeable locations.Thanks to Manuel Rickli & Philippe Leiser of Oneconsult AG for reporting this vulnerability...