Invoke-BSOD

Invoke-BSOD 관리자 권한 없이 컴퓨터를 종료시키고 싶을 때! BSOD 방식 출처: https://github.com/Leurak/MEMZ/blob/master/WindowsTrojan/Source/Destructive/KillWindows.cL10-L18 Invoke-BSOD.ps1 관리자 권한 없이 블루 스크린 오브 데스BSOD를 유발하는 PowerShell 스크립트입니다. 또한 Windows 크래시 덤프 설정을 열거합니다. 이것은 독립형 스크립트이며, 다른 파일에 의존하지 않습니다. Invoke-BSOD 블루 스크...

swarmer

swarmer EDR/AVから隠れてHKCUにレジストリキーを追加するためのツールです。管理者権限がなくても動作します。 使用方法 注意: この操作は一度だけ実行できます。NTUSER.MANが新しいレジストリハイブになった後は、管理者でなければ変更できません。最初の実行で必要な変更をすべて確実に行ってください。 regquery BOFの結果を使用する場合 1. 適切な reqquery BOFを https://github.com/trustedsec/CS-Situational-Awareness-BOF/tree/master/SA/regquery から入手します。 2...

Invoke-SessionHunter

Invoke-SessionHunter 원격 컴퓨터에서 활성 사용자 세션에 대한 정보를 검색하고 표시합니다. 관리자 권한이 필요하지 않습니다. 이 도구는 원격 레지스트리 서비스를 활용하여 원격 컴퓨터의 HKEYUSERS 레지스트리 하이브를 쿼리합니다. 활성 사용자 세션과 관련된 SID보안 식별자를 식별 및 추출하고, 이를 해당 사용자 이름으로 변환하여 현재 로그인한 사용자에 대한 정보를 제공합니다. -CheckAdminAccess 스위치가 제공되면 Invoke-WMIRemoting을 사용하여 로컬 관리자 권한이 있는 대상에 인증...

sshuttle

sshuttle: 투명 프록시와 VPN과 ssh의 만남 제가 알기로, sshuttle은 다음과 같은 일반적인 상황을 해결하는 유일한 프로그램입니다: 클라이언트 머신또는 라우터이 Linux, FreeBSD, MacOS, 또는 Windows 실험적입니다. ssh를 통해 원격 네트워크에 접근할 수 있습니다. 원격 네트워크에 반드시 관리자 권한이 있는 것은 아닙니다. 원격 네트워크에 VPN이 없거나, 형편없거나 복잡한 VPN 프로토콜IPsec, PPTP 등만 있습니다. 아니면 당신이 바로 관리자이고 VPN 도구들의 끔찍한 상태에 그저...

Invoke-WCMDump

Invoke-WCMDump Windows 자격 증명 관리자에서 자격 증명을 덤프하는 PowerShell 스크립트 Invoke-WCMDump는 자격 증명 관리자에서 Windows 자격 증명을 열거한 후 각각에 대해 사용 가능한 정보를 추출합니다. 비밀번호는 "Generic" 유형의 자격 증명에 대해 검색되지만, "Domain" 유형의 자격 증명에 대해서는 동일한 방법으로 검색할 수 없습니다. 자격 증명은 현재 사용자에 대해서만 반환됩니다. 관리자 권한이 필요하지 않습니다! 저자: Barrett Adams @peewpw 예제...

bw-dump

BW-Dump Updated 2 : この脆弱性には CVE-2023-38840 が割り当てられました。 Updated : パッチがGitHubプルリクエスト 5813 で公開され、脆弱性が修正されました。影響を受けるバージョンはBitwarden Desktop 2023.7.0 以下です。 説明 Windows システム上のロックされたBitwardenボールト（少なくとも一度はロック解除されている必要があります）からマスターパスワードを抽出する概念実証ツールです。現在のセッションでのみ機能し、システムの再起動後は機能しません。管理者権限は不要です。...

EUVD-2026-82379

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machinescript.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The atta...

CVE-2026-48085

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBALADMIN accounts without...

CVE-2026-48085 OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBALADMIN accounts without...

Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller

Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine. They codenamed the flaw Certighost. Because Domain Controller accounts carry directory...

CVE-2026-15379 Arbitrary File Read as SYSTEM in Symantec ITMS

The Altiris WMI provider exposes a class AltirisAgentStream that allows any local standard user to read the contents of any file accessible to the SYSTEM account, bypassing filesystem ACLs. No admin privileges required. The provider reverts to the LocalSystem context when servicing WMI queries...

PT-2026-60420

The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action it allows any edit posts user, so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide,...

CVE-2026-55790 Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

Craft CMS is a content management system CMS. In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types...

CVE-2026-55790 Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

Craft CMS is a content management system CMS. In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types...

CVE-2026-13164

Missing Authentication for Critical Function CWE-306 in the RegisterView apps/accounts/views.py, exposed at POST /api/auth/register/, in MailerUp 1.0.1 allows a remote, unauthenticated attacker to self-register a working account on instances where registration is intended to be restricted, becaus...

GHSA-WHXW-24JC-CWMV Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header

TL;DR This vulnerability affects Kirby sites that have no configured user accounts and are running on publicly accessible servers behind a reverse proxy that sets the Forwarded: for=..., X-Client-IP, or X-Real-IP request header. It was possible to install the Panel = create the first admin user i...

PT-2026-50724

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.4 Kirby versions prior to 5.4.4 Description An external initialization issue exists in the Kirby Panel and REST API. This occurs when a site has no configured user accounts and is hosted on a publicly accessible...

CVE-2026-32625

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, the Model Context Protocol MCP server integration resolves $VAR placeholders against the server's process.env during Zod schema validation of user-supplied MCP server URLs. Any...

CVE-2026-44738

Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray from within a page body, dumping the entire merged site configuration — including all plugin secrets SMTP passwords, AWS keys, OAuth client secrets...

CVE-2026-44738 Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()

Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray from within a page body, dumping the entire merged site configuration — including all plugin secrets SMTP passwords, AWS keys, OAuth client secrets...