BaRMIe

BaRMIe BaRMIe is a tool for enumerating and attacking Java RMI Remote Method Invocation services. RMI services often expose dangerous functionality without adequate security controls, however RMI services tend to pass under the radar during security assessments due to the lack of effective testin...

TrickDump

TrickDump TrickDump dumps the lsass process without creating a Minidump file, generating instead 3 JSON and 1 ZIP file with the memory region dumps. In three steps: Lock : Get OS information using RtlGetVersion. Shock : Get SeDebugPrivilege privilege with NtOpenProcessToken and...

SharpAppLocker

SharpAppLocker C port of the Get-AppLockerPolicy PowerShell cmdlet with extended features. Includes the ability to filter and search for a specific type of rules and actions. Useful when you already bypassed AppLocker initially and you don't want to leave PS logs Looking for a pre-compiled versio...

hacks

Hacks Hacky one-off scripts, tests etc...

exrop

Exrop 面向 x86-64 二进制文件的自动 ROP 链生成器，基于 Triton 符号执行引擎。 特性 将寄存器设置为常量或其他寄存器的值（rdi=0x41414141，rdi=rax） 写入内存（支持常量和基于寄存器的地址/值） 将字符串/字节写入内存 函数调用，支持混合常量/寄存器/字符串参数（open"/etc/passwd", 0） 系统调用链 坏字符规避 支持非返回型 gadget（jmp reg, call reg） 栈迁移，配合 JOP 链搜索用于内核漏洞利用 内核模式，自动重写 retpoline thunk 仅清理模式，过滤带有危险副作用内存写入的 gadget...

Syborg

Syborg Syborg is a Recursive DNS Domain Enumerator which is neither active nor completely passive. This tool simply constructs a domain name and queries it with a specified DNS Server. Syborg has a Dead-end Avoidance system inspired from @Tomnomnom's ettu. When you run subdomain enumeration with...

Slink

Slink is an alphanumeric shellcode x86 encoder that use simple math operations to reformat characters beyond 7f. The tool creation was inspired by the following sploit EDB-ID: 44455. Here's the list of current features: Encode using 01-7f characters set. Exclude common bad characters such as...

SharpSpray

SharpSpray SharpSpray is a Windows domain password spraying tool written in .NET C. Introduction SharpSpray is a C port of DomainPasswordSpray with enhanced and extra capabilities. This tool uses LDAP Protocol to communicate with the Domain active directory services. Features Can operate from...

No-Consolation

No-Consolation 这是一个 Beacon 对象文件（BOF），用于内联执行非托管 PE 并获取其输出，而无需分配控制台（即生成 conhost.exe 进程）。 功能 支持 64 位和 32 位 支持 EXE 和 DLL 不创建新进程 不创建新线程 将模块链接到 PEB 在内存中保存二进制文件 支持 C++ 异常（仅限 x64） 自定义加载所有依赖项 用法 root@kitploit: Summary: Run an unmanaged EXE/DLL inside Beacon's memory. Usage: noconsolation --local --inthrea...

CVE-2026-89951

CVE-2026-89951 affects the batman-adv module in the Linux kernel. During fragment reassembly, the skb from the highest-numbered buffered fragment is reused as the merged packet. If that fragment was received on a hard interface that is deleted before reassembly completes, the merged skb re-enters...

dyen

dyen dyen 使用 macOS 自带的 Python 在内存中加载 Mach-O dylib，并在不调用 dlopen 的情况下调用该 dylib 的导出入口点。其目标是使映像永远不会以独立文件的形式出现在目标上，也永远不会注册到 dyld。 作者：cenobyte [email protected] 2026 https://github.com/cenobyte-vincit/dyen Summary dyen 是一个仅使用标准库的 Mach-O 内存加载器（loader.py），适用于 macOS 上自带的 /usr/bin/python3。它读取普通...

Linux Distros Unpatched Vulnerability : CVE-2026-89951

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: fix stale receive device on merged fragments Fragment reassembly reuses the skb from the highest-numbered buffered fragment as the merged packet. Wh...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: riscv/mm: Added handling for VMFAULTSIGSEGV in mmfaulterror. Handle VMFAULTSIGSEGV in the page fault path so that we can correctly kill the process without causing bugs in the kernel...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Update log-pagemask,bits if log-pagesize changes. If an NTFS file system is mounted to another system with a different PAGESIZE than the original system, log-pagesize will change in logreplay, but log-pagemask,bits will...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: f2fs: A fix was made to perform a sanity check on the destination blkaddr during recovery. As Wenqing Liu reported in Bugzilla: https://bugzilla.kernel.org/showbug.cgi?id=216456 loop5: A change in capacity was detected, from 0...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: KVM: Always flush the async PF workqueue when a vCPU is being destroyed. Whenever a vCPU clears its completion queue, i.e., when a VM and all its vCPUs are being destroyed, the async PF workqueue must always be flushed. KVM must...

Astra Linux – Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: afbluetooth: Fixed deadlock issues Attempting to use socklock on .recvmsg may cause a deadlock as shown below. Therefore, instead of using socksock, use skreceivequeue.lock on btsockioctl to avoid UAF: INFO: Task...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix multiple LUNRESET handling This fix addresses a bug where the initiator assumes that a LUNRESET has cleaned up running commands, when in fact it hasn’t. The bug was introduced in commit 51ec502a3266 “target:...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: HID: hid-pl: handling probe errors Errors in the init process must be reported back; otherwise, we will follow a NULL pointer the first time FF is used...

Astra Linux – Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: i2c: lpi2c: Avoid calling clkgetrate during transfer Instead of repeatedly calling clkgetrate for each transfer, lock the clock rate and cache the value. A deadlock was observed when adding the tlv320aic32x4 audio codec to the...