execute-assembly-pico

Ejecutar ensamblado PICO Un PICO para Crystal Palace que implementa hosting CLR nativo para ejecutar un ensamblado .NET adjunto en memoria, usando la misma técnica que el generador de shellcode donut. Esto te permite cargar herramientas .NET como Rubeus o Seatbelt desde código independiente de...

ADSearch

ADSearch 一个为 cobalt-strike 的 execute-assembly 命令编写的工具，用于更高效地查询 AD。 主要功能 列出所有域管理员 自定义 LDAP 搜索 连接到 LDAPS 服务器 从 AD 实例输出 JSON 数据 从通用查询中检索自定义属性（例如所有计算机） 用法 ADSearch 1.0.0.0 Copyright c 2020 USAGE: 远程或本地查询 Active Directory： ADSearch --domain ldap.example.com --password AdminPass1 --username admin --use...

RedPersist

RedPersist RedPersist 是一个用 C 编写的 Windows 持久化工具 编译项目 本项目使用了以下第三方库。 TaskScheduler https://github.com/dahall/TaskScheduler Fody https://github.com/Fody/Fody 打开 Visual Studio 项目，转到 "工具" "NuGet 包管理器" "包管理器设置" 打开 "NuGet 包管理器" "包源" 安装 Fody Install-Package Costura.Fody -Version 3.3.3 安装 TaskScheduler...

java-stager

java-stager A PoC Java Stager which can download, compile, and execute a Java file in memory. This is for research purposes only, do not use this where you are unauthorised to do so. What is this? This is based on the work of James Williams from his talk "Next Gen AV vs My Shitty Code" available...

idacode

IDACode IDACode makes it easy to execute and debug Python scripts in your IDA environment without leaving Visual Studio Code. The VS Code extension can be found on the marketplace. IDACode is still in a very early state and bugs are to be expected. Please open a new issue if you encounter any...

toastnotify-bof

toastnotify-bof 一个用于发送Windows Toast通知的信标对象文件（BOF）。配合博客文章了解完整上下文和用例。 子命令 getaumid 枚举系统中注册的AUMID（应用程序用户模型ID）。在发送Toast之前，使用此命令查找合适的身份以借用。 inline-execute toastnotify.o go getaumid 示例输出： Notifications\Settings - HKCU Microsoft.Windows.Explorer MSEdge com.squirrel.AnthropicClaude.claude...

Jenkins build-metrics 1.3 - Cross-Site Scripting

Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. id: CVE-2019-10475 info: name: Jenkins build-metrics 1.3 - Cross-Site Scripting author: madrobot severity...

VvvebJs < 1.7.5 - Arbitrary File Upload

Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php. id: CVE-2024-29272 info: name: VvvebJs 1.7.5 - Arbitrary File Upload author: s4e-...

Jan v0.4.12 - Arbitrary File Upload

An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file. id: CVE-2024-36858 info: name: Jan v0.4.12 - Arbitrary File Upload author: pussycat0x severity: critical description: | An arbitrar...

mooSocial v.3.1.8 - Cross-Site Scripting

Cross-Site Scripting XSS vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function. id: CVE-2023-44813 info: name: mooSocial v.3.1.8 - Cross-Site Scripting author: ritikchaddha severity:...

Inline-Execute-PE

Inline-Execute-PE 免责声明： 本项目较为复杂，若未能理解其工作原理并充分测试，可能导致Beacon崩溃并失去访问权限！ 强烈建议您阅读“设计考量与评述”部分之前的所有文档！ 简介 Inline-Execute-PE 是一套 Beacon 对象文件（BOF）及对应的 CobaltStrike Aggressor 脚本，使操作员能够将非托管的 Windows 可执行文件加载到 Beacon 内存中并执行，捕获其输出并在 Beacon 控制台中显示。 这使操作员能够使用许多第三方工具（Mimikatz、Dsquery、Sysinternals 工具等），而无需将其写入磁盘、使...

CVE-2026-107728

The Strawberry GraphQL library (versions 0.217.0 through 0.326.1) contains a vulnerability in PermissionExtension.resolve() where synchronous field resolvers may incorrectly grant access. When a custom permission's has_permission() is a normal function returning an awaitable, the system fails to ...

EUVD-2026-95260

System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to...

CVE-2026-106126

A command injection vulnerability exists in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) . This flaw allows an authenticated, low-privileged attacker to execute arbitrary commands with SYSTEM privileges on the PDCe . The root cause is identified as CWE-78 (Improper Neu...

CVE-2026-84272 IBM Guardium Data Protection Missing Authentication

IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters...

EUVD-2026-95239

IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters...

CVE-2026-84272

IBM Guardium Data Protection versions 12.1 and 12.2.2 are vulnerable to a missing authentication flaw in the edge-controller component. An unauthenticated remote attacker can exploit this to execute arbitrary container images and seize control of managed edge clusters . No specific exploitation d...

EUVD-2026-95150

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NOBACKSLASHESCAPES mode, including in...

CVE-2026-93861

In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its projectid defaulted to the accepting project rather than t...

CVE-2026-93861

In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its projectid defaulted to the accepting project rather than t...