yaraQA

yaraQA YARAルールの品質とパフォーマンスを向上させるアナライザー なぜ？ YARAルールは構文的に正しいにもかかわらず、機能しない場合があります。yaraQAは、YARAルールセットの作成者やメンテナーに対して、これらの問題を見つけて報告します。 yaraQAが検出しようとする問題は、例えば以下の通りです： 構文的には正しいが、条件の誤りにより決してマッチしないルール（例：1つの文字列を持つルールで条件に 2 of them とある場合） おそらく間違っている文字列と修飾子の組み合わせを使用するルール（例：$ = "\Debug\" fullword）...

EDRUnChoker

EDRUnChoker EDRChoker 向けのファイルレスWMI修復ツール — EDRエージェントのネットワーク帯域をほぼゼロにまで絞るQoS悪用（pacer.sys）に対抗します。 root\subscription に永続サブスクリプションを登録します（ディスク上にファイルは残りません）。5秒タイマーが組み込みVBScriptを実行し、ActiveStore と GPO:localhost の WbemContextPolicyStore を使ってQoSポリシーを列挙します（通常のWMI ExecQuery では、New-NetQosPolicy / EDRChoker...

covert-control

covert-control Control systems remotely by uploading files to Google Drive, OneDrive, Youtube or Telegram using Python to create the files and the listeners. It allows to create text files, images, audio or videos, with the commands in cleartext or encrypted using AES. covert-googledrive.py -...

svja

svja The RDPS Super Vulnerable Java Applicationは、まさにその名の通り、一般的で、しばしば「複雑」なさまざまな脆弱性を誰でも確認できるように作成された、超脆弱なJavaアプリケーションです。このソフトウェアは、Roniel and DaRon Podcast Show https://www.youtube.com/channel/UCbj1JFcSJeTuf3qf9GPRemA...

resterm v1.8.1

Resterm A terminal API client for REST, GraphQL, gRPC, WebSocket and SSE. Resterm stores API requests in plain .http and .rest files that you can diff, review and track in version control. Edit and send requests in the terminal, or run them from scripts and CI. Request files support workflows,...

CVE-2026-11921

creationtimestamp| type| source ---|---|--- 2026-09-17 17:20:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvq5ziasyf2r...

CVE-2026-11928

creationtimestamp| type| source ---|---|--- 2026-09-17 17:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvq5zdvow52w...

autobloody

autobloody autobloody は、BloodHound に表示される Active Directory の権限昇格パスを自動的に悪用するツールです。 説明 このツールは、BloodHoundデータベースに権限昇格パスが存在する場合、2つのADオブジェクト（所有しているソースと目的のターゲット）間のAD権限昇格を自動化します。 自動化は2つのステップで構成されています： BloodHoundデータとNeo4jクエリを使用して、最適な権限昇格パスを見つける。 見つかったパスをbloodyADパッケージを使用して実行する。...

HTB-Facts-Writeup

HackTheBox — Facts マシン攻略記 マシン情報 項目| 詳細 ---|--- 名前| Facts OS| Linux 難易度| Easy リリース| Season 10 廃止| いいえ 攻撃チェーン概要 root@kitploit: Recon → Web Enumeration → CVE-2025-2304 Mass Assignment → S3/MinIO Credential Leak → SSH Key Extraction → Passphrase Cracking → User Shell → facter Sudo Abuse → Root 使用ツール ...

GHSA-FJ9W-C36G-H5X8 AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responses

Impact For SCRAM, and for Digest with mutual authentication, the client computes the server's verification value the SCRAM ServerSignature, or the Digest rspauth but does not act on the result. If the value is present and does not verify, the client only logs it and still delivers the response to...

AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responses

Impact For SCRAM, and for Digest with mutual authentication, the client computes the server's verification value the SCRAM ServerSignature, or the Digest rspauth but does not act on the result. If the value is present and does not verify, the client only logs it and still delivers the response to...

CVE-2026-93295

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. CakePHP's ShellDispatcher::parsePaths scans the entire argv for path switches -app,...

CVE-2026-93296

MISP contains a stored cross-site scripting XSS vulnerability in the Overmind theme's statistics views. The event General card eventgeneral.ctp and the server/feed preview card previewgeneral.ctp constructed donut chart legend labels by directly concatenating object name or category keys into an...

CVE-2026-93180

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix NPD issue on partial unmap of an evicted BO This commit fixes the NULL pointer dereference issue that would have happened on the split of GPU mapping due to partial unmap of an evicted BO. There is a logic to...

CVE-2026-93165

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Fix memory overread in ring handler maxresponse and sensornum are read from different EC commands: - maxresponse is from crosecgetprotoinfo. ecdev-maxresponse = info-maxresponsepacketsize - sizeofstruc...

HTB-Silentium-Writeup

HTB - Silentium 攻略記 マシン情報 名前: Silentium OS: Linux 難易度: Easy CVE: CVE-2025-58434, CVE-2025-59528, CVE-2025-8110 列挙 Nmap スキャン root@kitploit: nmap -sC -sV -p- --min-rate 5000 -oN nmap.txt 開放ポート: 22 SSH、80 HTTP 仮想ホストstaging.silentium.htb は Flowise 3.0.5 を実行しています 初期侵入 — Flowise RCE CVE-2025-58434 —...

CVE-2026-93159

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix heap info leak on I2C transfer failure The nonblocking RNG path allocates a workdata structure to track the state of an in-flight asynchronous I2C request. This pointer is stored in rng-priv and later...

CVE-2026-93089

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Free transport channel on IDR failure If transport channel setup succeeds but the following IDR insertion fails, the error path destroys the transport device and frees the channel info without invoking the...

GHSA-MGGC-4XG6-VCXF SSH.NET: ScpClient allows server-side RCE via default SCP path handling

Summary Default SCP remote-path handling places caller-supplied paths into the command that runs scp on the server. On a shell-based server that command is interpreted by a shell, so an attacker-influenced path that is not quoted to suit that shell can execute as a command as the authenticated SS...

SSH.NET: ScpClient allows server-side RCE via default SCP path handling

Summary Default SCP remote-path handling places caller-supplied paths into the command that runs scp on the server. On a shell-based server that command is interpreted by a shell, so an attacker-influenced path that is not quoted to suit that shell can execute as a command as the authenticated SS...