CVE-2021-43326_Exploit

CVE-2021-43326 익스플로잇 Automox Windows 에이전트 권한 상승 익스플로잇 Lacework Labs Blog Post https://www.lacework.com/blog/cve-2021-43326/ Automox Community Post https://community.automox.com/product-updates-4/cve-2021-43326-and-cve-2021-43325-local-privilege-escalation-in-automox-agent-windows-only-1636...

PULSE-C2

PULSE C2 프레임워크 HTTPS 명령 및 제어 인프라로, 원격 Windows 에이전트 관리를 위한 웹 대시보드를 제공합니다. ⚠️ 교육용 전용 - 불법 사용은 본인의 책임입니다. 기능 TLS 암호화를 지원하는 HTTPS C2 서버 Flask 실시간 웹 대시보드 XOR + Base64 암호화 프로토콜 영구 저장을 위한 SQLite 데이터베이스 원격 셸, 파일 유출, 비콘 제어 디버그 출력이 없는 무음 에이전트 빠른 시작 서버: cd server pip install flask python c2server.py 대시보드 접속:...

racketeer

Racketeer 프로젝트 - 랜섬웨어 시뮬레이션 툴킷 이 프로젝트의 목표는 팀이 회사 자산 및 네트워크 엔드포인트 집합에 대해 통제된 방식으로 일반적인 랜섬웨어 작동을 시뮬레이션하고 탐지 능력을 테스트할 수 있는 방법을 제공하는 것입니다. 배포 모델 Racketeer 툴킷은 에이전트/베이스 모델로 작동하며 현재 에이전트 수준에서 Windows OS 시스템을 지원하고, 명령 및 제어 베이스는 크로스 플랫폼입니다. 아키텍처 다이어그램 아키텍처 참조 더 읽기: 에이전트 베이스 운영 보안 OpSec 참조 유틸리티 유틸리티 참조...

CVE-2024-0670

CVE-2024-0670 – CheckMK 에이전트의 로컬 권한 상승 PowerShell PoC 요약 이 저장소는 CheckMK 에이전트의 Windows 로컬 권한 상승 취약점인 CVE-2024-0670 에 대한 독립적인 PowerShell 개념 증명 을 제시합니다. 이 취약점으로 인해 낮은 권한의 로컬 사용자가 MSI 복구 프로세스 중 예측 가능한 명령 파일 실행을 악용하여 NT AUTHORITY\SYSTEM 으로 권한을 상승시킬 수 있습니다. 이 구현은 elsevar11이...

CVE-2024-0670-CheckMK-Agent-Local-Privilege-Escalation-Exploit

CVE-2024-0670 – CheckMK 에이전트 로컬 권한 상승 PoC 이 저장소에는 CheckMK Windows 에이전트의 로컬 권한 상승 취약점인 CVE-2024-0670에 대한 간단하고 깔끔한 개념 증명PoC이 포함되어 있습니다. 낮은 권한의 사용자는 MSI 복구 중 실행되는 쓰기 가능한 임시 파일 경로를 악용하여 SYSTEM 권한을 얻을 수 있습니다. 🔍 취약점 요약 공급업체: Tribe29 CVE: CVE-2024-0670 권고:...

CVE-2024-9950-PoC

CVE-2024-9950-PoC Forescout SecureConnector = 11.3.07 상세 내 블로그 정보 취약점: 안전하지 않은 권한의 디렉터리에 임시 스크립트 생성 심각도: 중간높음 공격 벡터: 로컬 Windows OS 머신 공격 복잡성: 낮음 필요 권한: 낮음 분류: 로컬 권한 상승 애플리케이션 영향받는 구성 요소: Windows agent - Forescout eyeSight 및 eyeControl의 SecureConnector 영향받는 버전: Forescout SecureConnector = 11.3.07...

Kaseya VSA < 9.5.7 - Credential Disclosure via Windows Agent

Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client...

Linux Distros Unpatched Vulnerability : CVE-2026-83598

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without...

Linux Distros Unpatched Vulnerability : CVE-2026-83597

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as...

CVE-2026-83597

Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or...

DEBIAN-CVE-2026-83597

Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or...

CVE-2026-83597

Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or...

UBUNTU-CVE-2026-83597

Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or...

CVE-2026-83598

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShellprofile.ps1 from the low-privileged user who initiated repai...

DEBIAN-CVE-2026-83598

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShellprofile.ps1 from the low-privileged user who initiated repai...

CVE-2026-83597 Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution

Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or...

CVE-2026-83597 Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution

Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or...

CVE-2026-83597

The Netdata Windows Agent (versions 2.0.0 through 2.10.4) is vulnerable to a Local Privilege Escalation issue. During an MSI repair, the installer launches powershell.exe and wevtutil.exe as elevated interactive processes within the initiating user's desktop session. A low-privileged local user c...

CVE-2026-83597 Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution

Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or...

EUVD-2026-84565

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShellprofile.ps1 from the low-privileged user who initiated repai...