CVE-2016-5195

CVE-2016-5195 gcc -pthread dirty.c -o dirty -lcrypt Enlace de referencia https://github.com/FireFart/dirtycow/blob/master/dirty.c...

getSPNless

getSPNless Herramienta en Python para obtener tickets de servicio Kerberos utilizando la técnica SPN-less. Basado en Explotando RBCD Usando una Cuenta de Usuario Normal. Esta herramienta utiliza el proyecto impacket. Instalación Estas herramientas son solo compatibles con Python 3.5+. Clona el...

nysm

nysm A stealth post-exploitation container. Table of Content 1. Introduction 2. Installation 2.1 Requirements 2.2 Linux headers 2.3 Build 3. Usage 3.1 Examples 4. How it works 4.1 In general 4.2 Hide eBPF objects 4.3 Hide Auditd logs 4.4 Hide PIDs 4.5 Hide sockets 5. Limitations Introduction...

nysm

nysm Un contenedor sigiloso de post-explotación. Tabla de contenido 1. Introducción 2. Instalación 2.1 Requisitos 2.2 Headers de Linux 2.3 Compilación 3. Uso 3.1 Ejemplos 4. Cómo funciona 4.1 En general 4.2 Ocultar objetos eBPF 4.3 Ocultar registros de Auditd 4.4 Ocultar PIDs 4.5 Ocultar...

Pyramid

Pyramid ¿Qué es? Pyramid está compuesto por: 1. un servidor HTTP/S en Python que puede entregar archivos cifrados chacha, xor 2. módulos de Python que pueden cargar dependencias en memoria de herramientas ofensivas como Bloodhound-py, secretsdump, LaZagne, Pythonnet, DonPAPI, pythonmemorymodule,...

RingReaper

RingReaper RingReaper is a simple post-exploitation agent for Linux designed for those who need to operate stealthily, minimizing the chances of being detected by EDR solutions. The idea behind this project was to leverage iouring , the new asynchronous I/O interface in the Linux kernel,...

SCOMDecrypt

SCOMDecrypt - SCOM Credential Decryption Tool Released as open source by NCC Group Plc - http://www.nccgroup.trust/ Developed by Richard Warren, richard dot warren at nccgroup dot trust http://www.github.com/nccgroup/SCOMDecrypt Released under AGPL, see LICENSE for more information Introduction...

ysoserial

ysoserial A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. Description Originally released as part of AppSecCali 2015 Talk "Marshalling Pickles: how deserializing objects will ruin your day" with gadget chains for Apache Commons Collections 3.x and...

Thunderstorm

Thunderstorm Thunderstorm es un framework modular para explotar dispositivos UPS. Por ahora, solo están disponibles los exploits para CS-141 y NetMan 204. La versión beta del framework se lanzará en el futuro. CVE Thunderstorm es capaz actualmente de explotar los siguientes CVEs: CVE-2022-47186 –...

Chimera

Chimera Hardware Emulation & Proximity Exploitation Why Hak5 gear is heavy and obvious. My phone has a full Linux kernel in it, so I made it do the same job — HID emulation, RNDIS, mass storage, the whole thing — straight through ConfigFS. No extra hardware. No cables dangling out of a bag. Plug...

qu1ckdr0p2

About Rapidly host payloads and post-exploitation bins over HTTP or HTTPS. Designed to be used on exams like OSCP / PNPT or CTFs HTB / etc. Pull requests and issues welcome. As are any contributions. Qu1ckdr0p2 comes with an alias and search feature. The tools are located in the qu1ckdr0p2-tools...

put2win

put2win Script para automatizar la explotación del método HTTP PUT para obtener una shell. Instalación git clone https://github.com/sysdevploit/put2win cd put2win chmod +x put2win.sh Uso Script para automatizar la explotación del método HTTP PUT para obtener una shell. Options: -t TARGET URL/IP...

tactical-exploitation

tactical-exploitation "The Other Way to Pen-Test" -- HD Moore & Valsmith I've always been a big proponent of a tactical approach to penetration testing that does not focus on exploiting known software vulnerabilities, but relies on old school techniques such as information gathering and brute...

CVE-2016-2334

Exploiting CVE-2016-2334 7zip HFS+ vulnerability hfsGenerator.py Script used to generate HFS+ file heap.js WinDbg js script. After loading script, setup allocation hook in the following way: bp ntdll!RtlAllocateHeap "pt "dx Debugger.State.Scripts.heap.Contents.handleRtlHeapAlloc;g"" Next you can...

Strutscli

StrutsExp Usage strutsexp http://example.com/index.action...

XXEinjector

XXEinjector XXEinjector automatiza la recuperación de archivos utilizando métodos directos y fuera de banda. El listado de directorios solo funciona en aplicaciones Java. Para otras aplicaciones, se debe utilizar el método de fuerza bruta. Opciones: --host Mandatory - our IP address for reverse...

expliot

EXPLIoT Sustantivo: /ɛkˈsplʌɪəti:/ Un framework para pruebas de seguridad y explotación de productos IoT e infraestructura IoT. Proporciona un conjunto de plugins casos de prueba que se utilizan para realizar la evaluación y se pueden ampliar fácilmente con otros nuevos. El nombre EXPLIoT...

Bella

Bella Bella is a pure python post-exploitation data mining tool & remote administration tool for macOS. 🍎 💻 What is it? Bella is a robust, pure python, post-exploitation and remote administration tool for macOS. Bella a.k.a. the server is an SSL/TLS encrypted reverse shell that can be dropped on...

log4j-cve-2021-44228-sample

Example of log4j exploit This repo has a working sample of abusing the recent log4j exploit. It does not perform actual remote code execution, but shows you the ease at which a bad actor can have a vulnerable application call out to its own ldap server. This uses the excellent log4j sample...

liffy

Advanced LFI Exploitation Tool A powerful Python tool for Local File Inclusion LFI exploitation with advanced features including WAF bypass, encoding techniques, and comprehensive vulnerability detection. Liffy v2.0 is the significantly enhanced version of liffy which was originally created by...