Empire

Invoke-Obfuscation v1.8 介绍 Invoke-Obfuscation 是一个兼容 PowerShell v2.0+ 的 PowerShell 命令和脚本混淆器。 背景 2015 年秋季，我决定开始研究 PowerShell 语言的灵活性，并开始系统性地整理攻击者日常常用的几种技术所对应的各种实现方式。 最初专注于编码命令和远程下载负载语法，我发现一些不阻碍命令执行的转义字符会保留在命令行参数中，无论是运行中的进程还是安全事件日志 Security EID 4688 和 Sysmon EID 1 事件日志中记录的内容。这促使我系统地探索了混淆任何 PowerShell...

CVE-2026-75898

CVE-2026-75898 — Componente SSRF en Invoke de RAGFlow Server-Side Request Forgery CWE-918 en el componente "Invoke" del flujo de trabajo de agentes de RAGFlow, antes de 0.26.3. | ---|--- CVE| CVE-2026-75898 CVSS| 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Corregido en| v0.26.3 Commits de...

Invoke-sAMSpoofing

Invoke-sAMSpoofing CVE-2021-42287/CVE-2021-42278 的 PowerShell 利用工具 目录 概述 菜单 截图 参考 概述 一个简单的脚本，用于自动利用 CVE-2021-42287/CVE-2021-42278 攻击 AD。 菜单 Invoke-sAMSpooofing Invoke-GoldenTicket Invoke-GoldenTips RemoveMachineAccount Invoke-Rubeus ADSIHound Invoke-DCSync 截图 Invoke-sAMSpooofing...

Invoke-RunAsWithCert

Invoke-RunAsWithCert 一个 PowerShell 脚本，用于在未加入域的计算机上通过 Windows API 执行 PKINIT 身份验证。 描述 此 cmdlet 通过 PKINIT 使用指定证书创建新的登录会话。 其设计用于在未加入域的虚拟机中运行。该 cmdlet 有两种模式：一种用于设置注册表项，另一种用于修补 LSASS 内存，以绕过与域控制器证书相关的客户端检查。当在未加入域的计算机上运行时，这些检查会失败。 在注册表模式（默认）下，需要管理员权限来设置相关注册表项（并在最后恢复它们）。如果这些项已经设置好，则不需要管理员权限。此外，CA...

CVE-2025-54100

CVE-2025-54100 – PowerShell 响应解析 PoC 演示 CVE-2025-54100 如何通过恶意 HTML 解析，在 Windows PowerShell 5.1 中导致 远程代码执行（RCE） 。 什么是 CVE-2025-54100？ 漏洞类型： 当 Invoke-WebRequest 未使用 -UseBasicParsing 参数时存在命令注入风险 严重等级： CVSS 7.8（高危） 根本原因： 基于 MSHTML 的 HTML 响应解析允许脚本执行（如 ActiveXObject），并在调用者上下文中运行 受影响系统： Windows 10 / 11...

CVE-2026-57132

PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAICALLAUTH to disabled makes verifytoken accept requests to /api/v1/agents/id/invoke without CALLSERVERTOKEN authentication. Deployments that use the application's advertised opt-out can expose registered agents and their...

Astra Linux – Vulnerability in Linux

A issue was discovered in the Linux kernel through version 5.11.6. The fastrpcinternalinvoke function in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages, also known as CID-20c40794eb85. This is a related issue to CVE-2019-2308...

CVE-2026-57132: Improper Authentication

PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAICALLAUTH to disabled makes verifytoken accept requests to /api/v1/agents/id/invoke without CALLSERVERTOKEN authentication. Deployments that use the application's advertised opt-out can expose registered agents and their...

Exploit for CVE-2026-75898

CVE-2026-75898 — RAGFlow Invoke component SSRF Server-Side Re...

CVE-2026-55541

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, praisonai serve agents and praisonai serve unified parse --api-key but createagentsapp and createunifiedapp do not install a credential check. Unauthenticated callers can reach POST /agents and POST /api/v1/agents/id/invoke. This...

PT-2026-81330

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description In the serve subsystem, the praisonai serve agents and praisonai serve unified commands accept an --api-key flag for authentication, but the parsed value is not implemented within the FastAPI...

CVE-2026-55541: Missing Authorization

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, praisonai serve agents and praisonai serve unified parse --api-key but createagentsapp and createunifiedapp do not install a credential check. Unauthenticated callers can reach POST /agents and POST /api/v1/agents/id/invoke. This...

CVE-2026-74646

A flaw was found in the Linux kernel's fastrpc subsystem. When an invoke operation is interrupted by a signal, the fastrpcinternalinvoke function moves memory mappings without properly holding the fl-lock. This missing lock during memory map manipulation creates a race condition, which could lead...

CVE-2026-74646

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, waitforcompletioninterruptible returns -ERESTARTSYS and fastrpcinternalinvoke moves every buffer from fl-mmaps onto...

CVE-2026-74646 misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, waitforcompletioninterruptible returns -ERESTARTSYS and fastrpcinternalinvoke moves every buffer from fl-mmaps onto...

EUVD-2026-64583

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, waitforcompletioninterruptible returns -ERESTARTSYS and fastrpcinternalinvoke moves every buffer from fl-mmaps onto...

PT-2026-79651

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the fastrpc component of the Linux kernel. When an invoke operation is interrupted by a signal, the wait for completion interruptible function returns...

CVE-2026-52817 Linuxfabrik Monitoring Plugins Sudoers: /usr/bin/apt-get arguments allow privilege escalation

Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 5.1.0, the shipped assets/sudoers/Debian.sudoers policy allowed the nagios or icinga account to execute /usr/bin/apt-get as root without restricting its arguments. An attacker who...

CVE-2026-52817

In Linuxfabrik Monitoring Plugins prior to 5.1.0, the Debian.sudoers file allowed the nagios/icinga account to run /usr/bin/apt-get as root with unrestricted arguments. An attacker with the monitoring account can execute sudo apt-get update -o APT::Update::Pre-Invoke::="/bin/sh" to obtain a root ...

CVE-2026-75898

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component agent/component/invoke.py. The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or...