MalSeclogon

MalSeclogon 一个用于操作Seclogon服务的小工具。 完整技术细节见： https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-2.html https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html 用法 root@kitploit: MalSeclogon v0.2 @splintercode Args: -p Pid of the process to spoof the PPID through...

TREVORspray

TREVORspray 2.0 TREVORspray 是一个模块化密码喷洒工具，支持线程、SSH 代理、战利品模块等功能！ 作者：@thetechr0mancer 安装： root@kitploit: pip install git+https://github.com/blacklanternsecurity/trevorproxy pip install git+https://github.com/blacklanternsecurity/trevorspray 详细内容请参见配套的 博客文章，里面有有趣的吐槽和一些酷炫的演示！ 功能特性 多线程，大量线程 多种模块...

CVE-2018-9995-ModifiedByGwolfs

state This tools is an improved version of the CVE-2018-9995 wrote by gwolfs,and is for learning use only。Do not use for illegal purposes，all the consequences resulting from this are your own.The orginal version is wrote by ezelf and is on https://github.com/ezelf/CVE-2018-9995dvrcredentials Than...

honeybits

Honeybits 一款简单的PoC工具，旨在通过在您的生产服务器和工作站上散布面包屑（breadcrumbs）和蜜标（honeytokens）来增强陷阱的有效性，从而将攻击者引诱到您的蜜罐中。 作者：Adel "0x4D31" Karimi. 该项目的Windows版本：honeybits-win 背景 尽管安全研究人员多年来一直使用蜜罐来研究攻击者的工具、技术和动机，但它们仍未在生产环境中得到广泛接受和部署。原因之一在于传统蜜罐的实现是静态的，其成功与否取决于攻击者是否发现它（这通常需要网络扫描）！ 查看Mitre...

CVE-2020-1472

CVE-2020-1472 POC 需要从 GitHub 获取最新的 impacket，并添加了 netlogon 结构。 请注意，默认情况下这会更改域控制器账户的密码。这允许你进行 DCSync，但也会破坏与其他域控制器的通信，所以请小心操作！ 更多信息和原始研究请见 此处 利用步骤 阅读上述博客/白皮书，了解你在做什么 使用 DC 的 IP 和 NetBIOS 名称运行 cve-2020-1472-exploit.py 使用 secretsdump 进行 DCSync，使用 -just-dc 和 -no-pass 或空哈希以及 DCHOSTNAME$ 账户 恢复步骤 如果你安装了...

postEX

PostEX - 后渗透侦察代理 仅限授权的安全测试使用。未经授权使用是非法的。 PostEX 是一款基于 Python 的 Windows 后渗透侦察代理。它收集系统信息、权限状态、已安装补丁、防御机制、网络配置、凭据和持久化机制，然后生成结构化的 JSON 报告。 此外，PostEX 可选地将报告通过 OpenRouter API 发送给 LLM，以进行自动的红队（攻击路径）或蓝队（防御审计）分析。 功能特性 系统侦察 主机名、操作系统版本、构建版本、架构、CPU 当前用户、完整性级别（基于SID）、管理员状态 UAC 状态、完整权限列表 补丁枚举 从注册表中获取已安装的 KB 更新...

CVE-2026-92133

Jenkins GitLab Plugin 1.2149.vcfc32c82bf7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure...

CVE-2026-92133

Jenkins GitLab Plugin 1.2149.vcfc32c82bf7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure...

EUVD-2026-80757

Jenkins GitLab Plugin 1.2149.vcfc32c82bf7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure...

EUVD-2026-80754

Jenkins Pipeline: Multibranch Plugin 841.vec5b9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to...

EUVD-2026-79181

Server-Side Request Forgery SSRF in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for...

CVE-2026-91993

Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository...

CVE-2026-91993 Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list

Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository...

CVE-2026-77883

Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access LinkedAccount's if...

CVE-2026-78807

A flaw was found in wpasupplicant. A local attacker can exploit missing validation in the driver-based PMKSA Pairwise Master Key Security Association selection path to bypass proper network context and AKMP Authentication Key Management Protocol matching for PMKSA caching. This could allow the...

AZL-100172 CVE-2026-80928 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: smack: fix cred UAF in smackfilesendsigiotask When inspecting the credentials of another task, objective credentials -realcred, accessed with taskcred must always be used. Accessing -cred on a non-current task is forbidden unless...

CVE-2026-80928

In the Linux kernel, the following vulnerability has been resolved: smack: fix cred UAF in smackfilesendsigiotask When inspecting the credentials of another task, objective credentials -realcred, accessed with taskcred must always be used. Accessing -cred on a non-current task is forbidden unless...

CVE-2026-80928 smack: fix cred UAF in smack_file_send_sigiotask()

In the Linux kernel, the following vulnerability has been resolved: smack: fix cred UAF in smackfilesendsigiotask When inspecting the credentials of another task, objective credentials -realcred, accessed with taskcred must always be used. Accessing -cred on a non-current task is forbidden unless...

CVE-2026-88017

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

PT-2026-89488

Summary The FTP auth-proxy driver stores one obscured password per username in a server-wide map. It does not bind the credential or returned VFS to the authenticated FTP session. If two accepted credentials use the same username but resolve to different proxy backends, the later login overwrites...