shepard

SHEPARD BITS This is a persistance tool using Windows Background Intelligent Transfer Service BITS. Functionality File Download, File Exfiltration, File Download + Persistent Execution Usage Run shepard.exe as Administrator with the following command line arguments: -d : regular file download to ...

RogueWinRM

RogueWinRM RogueWinRM is a local privilege escalation exploit that allows to escalate from a Service account with SeImpersonatePrivilege to Local System account if WinRM service is not running default on Win10 but NOT on Windows Server 2019. Briefly, it will listen for incoming connection on port...

testing-handbook

Trail of Bits Testing Handbook The Trail of Bits Testing Handbook is a resource for developers and security professionals on configuring, optimizing, and automating many static and dynamic analysis tools we use at Trail of Bits. Preview Testing Handbook: https://appsec.guide 🌐 Why is this needed?...

longfellow-zk

Longfellow ZK Overview The Longfellow library enables the construction of zero-knowledge protocols concerning legacy identity verification standards such as the ISO MDOC standard, the JWT standard, and W3 Verifiable Credentials. This implementation is described in: Anonymous credentials from ECDS...

LOLBITS

root@kitploit: ██╗ ██████╗ ██╗ ██████╗ ██╗████████╗███████╗ ██║ ██╔═══██╗██║ ██╔══██╗██║╚══██╔══╝██╔════╝ ██║ ██║ ██║██║ ██████╔╝██║ ██║ ███████╗ ██║ ██║ ██║██║ ██╔══██╗██║ ██║ ╚════██║ ███████╗╚██████╔╝███████╗██████╔╝██║ ██║ ███████║ ╚══════╝ ╚═════╝ ╚══════╝╚═════╝ ╚═╝ ╚═╝ ╚══════╝ Table of...

CVE-2023-41717

CVE-2023-41717 Inappropriate file type control in Zscaler Proxy versions 3.6.1.25 and prior allows local attackers to bypass file download/upload restrictions. Executive Summary During the summer of 2022, I have found a vulnerability affecting the ZScaler proxy versions 3.6.1.25 and prior. This...

publications

Publications from Trail of Bits Publications from Trail of Bits Academic Papers White Papers Guides and Handbooks Conference Presentations Automated bug finding and exploitation Blockchain Compilers Cryptography Engineering Education Infrastructure Machine Learning Mobile security Programming Sid...

skills

Trail of Bits スキルマーケットプレイス Trail of Bits が提供する Claude Code プラグインマーケットプレイス。AI 支援によるセキュリティ分析、テスト、開発ワークフローを強化するスキルを提供します。Codex は、Claude マーケットプレイスの互換性を通じてこのマーケットプレイスを読み込むことができます。 関連情報: claude-code-config · skills-curated · claude-code-devcontainer · dropkit インストール Claude Code マーケットプレイス root@kitploit:...

HashSiphon

HashSiphon 通过 HTTP 层身份验证代理提取 NTLM 哈希，攻击者进程零 SSPI 调用。 HashSiphon 通过操纵 HTTP 身份验证流程而非直接调用 SSPI API 来提取当前用户的 NetNTLMv2 哈希。它提供两个变体：v1 在同一进程内通过 .NET 的 HTTP 栈路由 NTLM 身份验证，v2 将身份验证完全委托给不同 PID 中的 BITS 服务（svchost.exe），从而彻底打破进程级归因。 为什么这很重要 所有已知的 NTLM 哈希自提取工具 Internal Monologue、手动 SSPI 脚本及其衍生工具都会从攻击者自己的进程调用...

claude-code-devcontainer

开发容器中的 Claude Code 一个沙盒化开发环境，可安全启用 bypassPermissions 运行 Claude Code。由 Trail of Bits 为安全审计工作流构建。 为何使用此方案？ 在宿主机上使用 bypassPermissions 运行 Claude 存在风险——它可以在不确认的情况下执行任何命令。此开发容器提供了文件系统隔离 ，让你既能享受无限制 Claude 带来的生产力提升，又不会危及宿主机安全。 适用场景： 安全审计 ：审查客户端代码而不危及宿主机 不可信仓库 ：安全探索未知代码库 实验性工作 ：让 Claude 在隔离环境中自由修改代码 多仓库协作...

http-protocol-exfil

http-protocol-exfil HTTPプロトコルバージョンを使用して、ファイルを1ビットずつ送信します（"HTTP/1.0"は0、"HTTP/1.1"は1を表します）。GETリクエストを使用するため、Blue TeamはあなたのIPアドレスへのリクエストのみを確認します。ただし、大きなファイルを送信するには時間がかかり、例えば200KBを送信するのに1時間必要で、リクエスト数は非常に多くなります（ファイルのバイト数の8倍）。 リスナーの作成 リスナーを実行するには、listener.pyを使用します。オプションの引数としてリッスンするポートを指定します。...

shepard

SHEPARD BITS これは、Windows Background Intelligent Transfer Service BITS を利用した永続化ツールです。 機能 ファイルダウンロード、ファイル流出、ファイルダウンロード＋永続的実行 使用方法 shepard.exe を管理者として実行し、以下のコマンドライン引数を指定します： -d : 任意のローカルパスへの通常のファイルダウンロード -e : 任意のローカルパスからの通常のファイルアップロード（IISサーバーのみに送信します。これはBITSの制限です） -dr optionalFileArgs :...

CVE-2026-88922

A flaw was found in the go-getter library. This vulnerability allows a local attacker to escalate privileges by providing a specially crafted archive. When a privileged user extracts this archive, files can be created with elevated permission bits, enabling the attacker to gain the privileges of...

manticore

⚠️ プロジェクトはアーカイブされました ⚠️ このプロジェクトは、もはや内部で開発・保守されていません。 Manticore...

Security Bulletin: Go-getter vulnerable to a privilege escalation issue in its archive decompression handling

Summary The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged use...

AZL-103254 CVE-2026-88922 affecting package packer 1.9.5-20

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this...

CVE-2026-88922

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this...

CVE-2026-88922

go-getter (HashiCorp), a library used for fetching and extracting files, is vulnerable to a privilege escalation in its archive decompression handling in versions up to 1.8.8 and 2.2.3 . A crafted archive may cause extracted files to be created with elevated permission bits. When extraction is pe...

CVE-2026-88922 Go-getter vulnerable to a privilege escalation issue in its archive decompression handling

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this...

CVE-2026-88922 Go-getter vulnerable to a privilege escalation issue in its archive decompression handling

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this...