Modules

Modules Modules utilisés par le framework Havoc. Powerpick Implémentation de Powerpick pour le framework Havoc. InvokeAssembly Implémentation de InvokeAssembly pour le framework Havoc. Template Il s'agit du modèle de base pour les modules. Vous pouvez l'utiliser pour écrire vos propres modules po...

cobaltstrike-headless

Headless Strike Script Aggressor qui transforme le client aggressor headless en client Cobalt Strike en grande partie fonctionnel. Utilisation connectez-vous à votre teamserver via l'utilitaire aggressor headless intégré ./agscript root@kitploit: ./agscript host port user password chargez le...

BOF_Collection

BOFCollection Divers BOFs pour Cobalt Strike Requirements beacon.h Pour les instructions de compilation et la vue d'ensemble des BOF : help-bof ActiveDirectory GetDomainInfo.c Retourne des informations sur le domaine actuel et le contrôleur de domaine. inline-execute GetDomainInfo.o Collection...

Defender_Exclusions-BOF

Defender Exclusions BOF Quoi Un BOF pour déterminer les exclusions de Windows Defender : Extensions Processus Dossiers Pourquoi Exemples d'utilisation du compilateur C++ pour créer des BOF sans avoir besoin des déréférencements intermédiaires de vtable. Compilation root@kitploit: cd src make all...

CVE-2025-9974

CVE-2025-9974 PoC !CAUTION This script is provided for educational and defensive research purposes only. It is designed strictly for use against owned hardware in isolated, sandboxed testing environments. Do not use this tool against systems you do not own or have explicit permission to test. The...

MAL-2026-16071 Malicious code in cat-sis2go-utils (npm)

cat-sis2go-utils is a dependency-confusion package published against the SIS2GO namespace, with versions inflated to 99.0.0 and 99.1.0. It ships no library code index.js is an 87-byte stub, and package.json declares both preinstall and postinstall running node scripts/run.js, so the payload...

Malicious code in cat-sis2go-utils (npm)

cat-sis2go-utils is a dependency-confusion package published against the SIS2GO namespace, with versions inflated to 99.0.0 and 99.1.0. It ships no library code index.js is an 87-byte stub, and package.json declares both preinstall and postinstall running node scripts/run.js, so the payload...

MAL-2026-16062 Malicious code in @yongot/canary-mcp-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b93b70d19f6065f9757e39a5d7f799ca9cfff26e2c47b6e4c51012a104885578 Package @yongot/[email protected] ships beacon.js which runs execSync'id', reads os.hostname, and issues an HTTPS GET to a hardcoded webhook.site...

MAL-2026-16051 Malicious code in @umschool/analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da14c2843514d3c9103335648bc81a8bce18fc173b27c2ab39ebe2c6c0abe028 @umschool/[email protected] targets the internal @umschool npm scope with an implausibly high version number to force resolution over any private...

MAL-2026-16008 Malicious code in b2b-frontend-external-library (npm)

This package is malicious. It is not a real library. An attacker put it on the public npm registry. The package name is a copy of a private, internal package name. This is a dependency confusion attack. A build that gets the name from public npm installs this package in place of the real one. The...

MAL-2026-16009 Malicious code in omni-channel-configurator-wireline-frontend (npm)

This package is malicious. It is not a real library. An attacker put it on the public npm registry. The package name is a copy of a private, internal package name. This is a dependency confusion attack. A build that gets the name from public npm installs this package in place of the real one. The...

MAL-2026-15626 Malicious code in fuels-forc (npm)

The package 'fuels-forc' was identified as containing malicious obfuscated code. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b993583bec4136d0b060dc6391c10e15f836e605b5b13b97dea6bb7a3dc1e5cd bin/cli.js runs whoami and reads os.hostname / os.platform, then POS...

China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access

VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics ZBT, each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices. The implants, named SPEAKINGSTONE and DARKLANTE...

SUSE CVE-2026-68470

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

Malicious code in ecobee-home (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a02620d2c1be5db8251957a24b2dacf01b146b1ee009169a9d828cb1f2a7425 The package's declared postinstall script runs beacon.js, which issues an HTTP GET to a hardcoded bare-IP endpoint http://169.58.96.170:9001/cb...

MAL-2026-14474 Malicious code in ecobee-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebaf39f3f17cfdfbddac8bb4f92aaa1fd600b7f0a69def35d879ebe5d90f14f On npm install, ecobee-api runs node beacon.js via its postinstall lifecycle script. The beacon issues an HTTP GET to the hardcoded bare-IP endpoint...

Malicious code in ecobee-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebaf39f3f17cfdfbddac8bb4f92aaa1fd600b7f0a69def35d879ebe5d90f14f On npm install, ecobee-api runs node beacon.js via its postinstall lifecycle script. The beacon issues an HTTP GET to the hardcoded bare-IP endpoint...

Malicious code in @medisend/shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb5857b17f9935d83581e1a24e6d990211fe86631143c7025c3123d1274e7d28 package.json declares a postinstall lifecycle script that runs curl at install time and transmits the installer's hostname via $hostname as a query...

MAL-2026-14423 Malicious code in @medisend/shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb5857b17f9935d83581e1a24e6d990211fe86631143c7025c3123d1274e7d28 package.json declares a postinstall lifecycle script that runs curl at install time and transmits the installer's hostname via $hostname as a query...

Malicious code in hydration-ui-dim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64f9565680b71c54ed88e29ed3950f1561764f4b86a260a3ebb5eadb528edfa3 On import 'hydration-ui-dim', dist/index.mjs runs a top-level async IIFE that chmods dist/internal/calc-math.dat to 0755 and spawns it detached via...