288 matches found
PULSE-C2
PULSE C2 Framework HTTPS Command & Control infrastructure with web dashboard for remote Windows agent management. ⚠️ Educational Use Only - Illegal use = your responsibility. Features HTTPS C2 server with TLS encryption Flask Real-time web dashboard XOR + Base64 encrypted protocol SQLite database...
CVE-2021-43326_Exploit
CVE-2021-43326 Exploit Automox Windows Agent Privilege Escalation Exploit Lacework Labs Blog Post https://www.lacework.com/blog/cve-2021-43326/ Automox Community Post...
racketeer
Racketeer Project - Ransomware simulation toolkit The goal of this project is to provide a way for teams to simulate and test detection of common ransomware operation, in a controlled manner, against a set of company assets and network endpoints. Deployment model The Racketeer toolkit operates on...
CVE-2024-0670
CVE-2024-0670 – CheckMK Agent のローカル特権昇格（PowerShell PoC） 概要 このリポジトリは、CheckMK Agent における Windows のローカル特権昇格の脆弱性である CVE-2024-0670 に対する独立した PowerShell 概念実証（PoC）を提供します。この脆弱性により、低権限のローカルユーザーが MSI 修復プロセス中の予測可能なコマンドファイル実行を悪用して、NT AUTHORITY\SYSTEM へ特権昇格できる可能性があります。 この実装は、elsevar11 氏による公開...
CVE-2024-0670-CheckMK-Agent-Local-Privilege-Escalation-Exploit
CVE-2024-0670 – CheckMK Agent Local Privilege Escalation PoC This repository contains a simple and clean proof-of-concept for CVE-2024-0670, a local privilege escalation vulnerability in the CheckMK Windows Agent. A low-privileged user can gain SYSTEM privileges by abusing writable temp file path...
CVE-2024-9950-PoC
CVE-2024-9950-PoC Forescout SecureConnector = 11.3.07 상세 내 블로그 정보 취약점: 안전하지 않은 권한의 디렉터리에 임시 스크립트 생성 심각도: 중간높음 공격 벡터: 로컬 Windows OS 머신 공격 복잡성: 낮음 필요 권한: 낮음 분류: 로컬 권한 상승 애플리케이션 영향받는 구성 요소: Windows agent - Forescout eyeSight 및 eyeControl의 SecureConnector 영향받는 버전: Forescout SecureConnector = 11.3.07...
Kaseya VSA < 9.5.7 - Credential Disclosure via Windows Agent
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client...
CVE-2026-40106 Wazuh: Heap-based Buffer Overflow in syscheck Registry Wildcard Expansion (LPE / DoS)
Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.6.0 and above prior to 4.14.5 contain a heap-based buffer overflow vulnerability in the syscheck component of the Wazuh agent for Windows. When expanding registry paths containing wildcards or...
MAL-2026-10756 Malicious code in darkglitch (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a84fec55fc625d5e2b337aafe5a9a95ff30c47403241c59dbb33543ec97311a The package installs a listener CLI darkglitch -l -b that opens a WebSocket to the hardcoded signaling host malware-signal.vercel.app and joins the...
PT-2026-60610
Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.6.0 and above prior to 4.14.5 contain a heap-based buffer overflow vulnerability in the syscheck component of the Wazuh agent for Windows. When expanding registry paths containing wildcards or...
Vulnerabilities exist in several Fortinet products
Fortinet has identified vulnerabilities in several versions of FortiSIEM Windows Agent and general product versions, FortiOS, FortiPAM, and FortiProxy. One vulnerability exists in the FortiSIEM Windows Agent versions 7.4.0 through 7.4.1 with the identifier CVE-2026-59841. This vulnerability allow...
CVE-2026-59841
Technical details for CVE-2026-59841 are not publicly available in the provided documents. Monitor Fortinet advisories and NVD/CVE records for updates on affected product/version, impact, and fixes.
Malicious code in logger-daemon-regex (npm)
The npm package logger-daemon-regex is a full-spectrum information stealer and remote-control agent disguised as a "Node.js integration layer for Autodesk Forge" all bin names are forge-. A postinstall lifecycle hook chains five scripts postinstall-clipboard-event, ensure-dist,...
Veeam Backup and Replication < 13.0.2.29 (kb4852)
The version of Veeam Backup and Replication installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the kb4852 advisory. - A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on...
CVE-2024-47091 Privilege escalation via mk_mysql agent plugin on Windows
Privilege escalation in the mkmysql agent plugin on Windows in Checkmk 2.4.0p29, 2.3.0p47, and 2.2.0 EOL allows a local unprivileged user able to create a Windows service whose name matches 'MySQL' or 'MariaDB' or with write access to a binary referenced by such a service to execute arbitrary cod...
PT-2026-40585
Privilege escalation in the mk mysql agent plugin on Windows in Checkmk 2.4.0p29, 2.3.0p47, and 2.2.0 EOL allows a local unprivileged user able to create a Windows service whose name matches 'MySQL' or 'MariaDB' or with write access to a binary referenced by such a service to execute arbitrary co...
Amazon ECS Container Agent (Windows) is vulnerable to Information Disclosure
Summary Amazon Elastic Container Service Amazon ECS is a fully managed container orchestration service that enables customers to deploy, manage, and scale containerized applications. An issue exists where, under certain circumstances, improper input validation in the FSx Windows File Server volum...
GHSA-FC67-C4HG-Q653 Amazon ECS Container Agent (Windows) is vulnerable to Information Disclosure
Summary Amazon Elastic Container Service Amazon ECS is a fully managed container orchestration service that enables customers to deploy, manage, and scale containerized applications. An issue exists where, under certain circumstances, improper input validation in the FSx Windows File Server volum...
CVE-2026-2123 Privilege escalation vulnerability in Operations Agent
A security audit identified a privilege escalation vulnerability in Operations Agent=OA 12.29 on Windows. Under specific conditions Operations Agent may run executables from specific writeable locations.Thanks to Manuel Rickli & Philippe Leiser of Oneconsult AG for reporting this vulnerability...