Persistnux

Persistnux 一个全面的Linux持久化检测工具，用于数字取证和事件响应（DFIR）调查。 概述 Persistnux 是一个基于 Bash 的工具，旨在识别攻击者用于维护对受感染系统访问权限的已知 Linux 持久化机制。它对系统执行全面检查，并生成 CSV 和 JSONL 格式的详细报告，便于进一步分析。 特性 全面检测 ：覆盖所有主要的 Linux 持久化机制 实时分析 ：直接在运行中的系统上运行，依赖最小 详细输出 ：生成 CSV 和 JSONL 报告，包含文件哈希、元数据和置信度评分 支持 Root 和非 Root ：可在有或没有 root 权限的情况下运行（非 roo...

DynastyPersist

DynastyPersist 1.5 DynastyPersist：一个简化 Linux 持久化操作的流线型工具。 支持 KoTH、Battlegrounds 和渗透测试操作 安装 • 文档 • 用法 文档 功能特性 功能特性| 描述 ---|--- SSH 密钥生成| 自动生成 SSH 密钥，用于隐秘访问。 计划任务持久化| 设置计划任务以实现定时持久化。 创建带 root 权限的自定义用户| 创建一个拥有 root 权限的自定义用户。 RCE 持久化| 通过远程代码执行实现持久化。 LKM/ Rootkit| 演示基于 Linux 内核模块 LKM 的 rootkit 持久化。...

persisthunt

Linux 持久化检测、威胁狩猎与取证工件收集 摘要 使用方法 检测示例 技术表 摘要 persisthunt.sh 通过收集与持久化相关的定向取证工件并高亮常见于 Linux 持久化技术的可疑模式，帮助加快调查速度。 该脚本协助检测持久化、威胁狩猎，并针对广为人知的 Linux 持久化机制收集工件。检测结果根据置信度和严重性分为三个级别 - 高、低 和 参考信息。示例包括引用 /tmp/、/home/、/dev/tcp、curl 的可疑自启动条目，或检测到活跃的绑定/反向 shell。...

D3m0n1z3dShell

「😈」关于 D3m0n1z3dShell Demonized Shell 是一个用于 Linux 持久化的高级工具。 Install git clone https://github.com/MatheuZSecurity/D3m0n1z3dShell.git cd D3m0n1z3dShell chmod +x demonizedshell.sh sudo ./demonizedshell.sh One-Liner Install Download D3m0n1z3dShell with all files: curl -L...

PANIX

PANIX - Persistencia contra NIX PANIX es un framework de persistencia para Linux potente, modular y altamente personalizable, diseñado para investigadores de seguridad, ingenieros de detección, pentesters, entusiastas de CTF y más. Construido con versatilidad en mente, PANIX enfatiza la...

Malicious code in json-validator-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 255dbc17164a6243a92bab0b4d71132efad3028b53e73d7d2924a1d7ccd1e8cf The package advertises itself as a JSON/XML validator but lib/core.js contains a multi-stage dropper triggered on any call to the public API...

Malicious code in ulid-xyz (npm)

ulid-xyz is a typosquat of the popular ulid library sortable unique IDs and is a cross-platform Remote Access Trojan delivered via a postinstall hook. The package.json postinstall superficially looks like an inline node -e guard that checks for the existence of a dist file, but it actually launch...

MAL-2026-1290 Malicious code in remjsonparse (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e478d1e016f1d6d6d1cb4a9d23ac45449c22d99aa8e71c88d2f38fae8951f23f During import, package starts advanced compromise actions: exfiltrates AWS and git credentials, commands history, security tools in use. After that, the code...

North Korea-linked Actors Exploit React2Shell to Deploy New EtherRAT Malware

Threat actors with ties to North Korea have likely become the latest to exploit the recently disclosed critical React2Shell security flaw in React Server Components RSC to deliver a previously undocumented remote access trojan dubbed EtherRAT. "EtherRAT leverages Ethereum smart contracts for...

APT36 Targets Indian Government with Golang-Based DeskRAT Malware Campaign

A Pakistan-nexus threat actor has been observed targeting Indian government entities as part of spear-phishing attacks designed to deliver a Golang-based malware known as DeskRAT. The activity, observed in August and September 2025 by Sekoia, has been attributed to Transparent Tribe aka APT36, a...

Metasploit Wrap-Up 10/03/2025

Windows LNK and Linux persistence This week, happybear-21 introduced four new modules that abuse Windows Shell Link LNK to execute various attacks. Three of these modules are designed to trigger authentication attempts to a remote server, facilitating the harvesting of NTLM authentication...

PayloadsAllTheThings - A List Of Useful Payloads And Bypass For Web Application Security And Pentest/CTF

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques ! Every section contains the following files, you can use the templatevuln folder to create a new chapter: README.md - vulnerability description and how to exploit it Intrud...