RawHive

RawHive RawHive — это BOF для Cobalt Strike, предназначенный для извлечения выбранных кустов реестра Windows напрямую из необработанного тома NTFS. Он обходит обычные файловые API, проходит по метаданным NTFS, находит целевые записи файлов и копирует байты прямо с диска. В настоящее время он ищет...

CVE-2021-36934

CVE-2021-36934 CVE-2021-36934 Vérificateur de vulnérabilité HiveNightmare et correctif Flux Le script suit le flux suivant : Nécessite d'être exécuté avec des privilèges Administrateur Vérifier si la version de Windows 10 est affectée par la vulnérabilité. SI affecté par la vulnérabilité : Affich...

HiveJack

HiveJack Cet outil peut être utilisé lors de tests de pénétration internes pour extraire des identifiants Windows d'un hôte déjà compromis. Il permet de vider les ruches SYSTEM, SECURITY et SAM du registre et, une fois copiées sur les machines de l'attaquant, offre une option pour supprimer ces...

go-secdump

go-secdump Description Package go-secdump is a tool built to remotely extract hashes from the SAM registry hive as well as LSA secrets and cached hashes from the SECURITY hive without any remote agent and without touching disk. The tool is built on top of the library go-smb and use it to...

hive

Из WikiLeaks: Сегодня, 9 ноября 2017 года, WikiLeaks публикует исходный код и журналы разработки Hive — основного компонента инфраструктуры ЦРУ для управления своим вредоносным ПО. Hive решает критическую проблему для операторов вредоносного ПО в ЦРУ. Даже самая изощрённая вредоносная закладка на...

aggrokatz

aggrokatz What is this aggrokatz is an Aggressor plugin extension for CobaltStrike which enables pypykatz to interface with the beacons remotely. The current version of aggrokatz allows pypykatz to parse LSASS dump files and Registry hive files to extract credentials and other secrets stored...

Registry-Spy

Registry Spy: Navigateur de registre Windows multiplateforme Registry Spy est un visualiseur de registre Windows gratuit, open-source et multiplateforme. C'est un explorateur rapide, moderne et polyvalent pour les fichiers de registre bruts. Fonctionnalités : Prise en charge de Windows, macOS et...

dfir-toolkit

!CAUTION DFIR Toolkit покидает GitHub Почему? Мы верим, что все люди — мужчины, женщины и все, кто между ними и за их пределами — созданы равными. При таком подходе бессмысленно судить людей по месту рождения, языку, цвету кожи, религии или чему-либо ещё. Мы верим, что человека определяют его...

backup_dc_registry

Backup Operator Registry Backup to Domain Compromise Простой POC, который злоупотребляет привилегиями Backup Operator для удалённого дампа кустов SAM, SYSTEM и SECURITY. Авторство исследования: @filipdragovic Портировано из Windows PoC от @mpgn Использование Эта proof of concept — модифицированна...

CVE-2021-36934-HiveNightmare-Lab

CVE-2021-36934 HiveNightmare - Laboratoire éducatif 🎯 Objectif Reproduire et analyser la vulnérabilité HiveNightmare dans un environnement de laboratoire contrôlé. 📋 Table des matières Description de la vulnérabilité Implémentation Démonstration Configuration du laboratoire et outils Étapes...

regipy

regipy ⚠️ Changements majeurs dans la v6.0.0 La version 6.0.0 inclut des changements de modernisation importants : Python 3.9+ requis - Abandon du support de Python 3.6, 3.7 et 3.8 Bibliothèqueattrs supprimée - Les classes de données utilisent désormais le module dataclasses intégré à Python Si...

CVE-2020-1472-Easy

CVE-2020-1472-Easy Ce n'est certainement pas quelque chose que vous voudriez exécuter sur quoi que ce soit qui vous tient à cœur. Construit à partir d'un rapport et du travail de @obfuscatee et d'une autre source Utilise du code provenant de https://github.com/dirkjanm/CVE-2020-1472...

CLEANSTART-2026-QW68592 Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit

Security vulnerability affects the apache-hive package. A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit...

CLEANSTART-2026-KU24747 Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack

Security vulnerability affects the apache-hive package. Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack...

CLEANSTART-2026-JK79354 Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect

Security vulnerability affects the apache-hive package. A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect...

CLEANSTART-2026-MN75797 Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active

Security vulnerability affects the apache-hive package. Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active...

CLEANSTART-2026-JC43217 Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is config...

Security vulnerability affects the apache-hive package. Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through...

CLEANSTART-2026-XM34051 Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or...

Security vulnerability affects the apache-hive package. Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value...

CLEANSTART-2026-VD50036 Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name

Security vulnerability affects the apache-hive package. Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name...

CLEANSTART-2026-LT41646 WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request

Security vulnerability affects the apache-hive package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...