PipeViewer

一个用于查看Windows命名管道并搜索不安全权限的GUI工具。 该工具是作为关于Docker命名管道的研究的一部分发布的： "Breaking Docker Named Pipes SYSTEMatically: Docker Desktop Privilege Escalation – Part 1" "Breaking Docker Named Pipes SYSTEMatically: Docker Desktop Privilege Escalation – Part 2" 概述...

Coercer

一个 Python 脚本，用于通过多种方法自动强制 Windows 服务器向任意机器进行身份验证。 Windows 支持 要构建 Windows 二进制文件，请从此仓库下载 installer.ps1 脚本。直接运行它（不带参数）即可在工作目录中创建二进制文件。使用 -h 或 --help 查看带选项的帮助菜单。 功能特性 核心功能： 列出远程机器上开放的 SMB 管道（在扫描认证和模糊测试认证模式下） 尝试连接远程机器上已知的 SMB 管道列表（在扫描未认证和模糊测试未认证模式下） 逐一调用所有易受攻击的 RPC 函数，以强制服务器向任意机器进行身份验证。 随机生成 UNC...

Remote-BOF-Runner

远程BOF运行器 一个Havoc扩展框架，用于通过使用Crystal Palace制作的PIC加载器远程执行Beacon对象文件（BOF）。 概述 远程BOF运行器通过利用Crystal Palace PIC加载器，能够在任意进程中安全执行BOF。该框架通过命名管道实现复杂的进程间通信（IPC）机制，将注入进程中的Beacon输出透明地转发回命令与控制（C2）服务器。 设置与安装 扩展安装 确保扩展安装在Havoc扩展目录中： root@kitploit: 你的HAVOC文件夹 + /data/extensions/ 依赖项 要编译PIC加载器，系统上必须安装以下工具和库：...

engine

Droidefense Engine Advance Android Malware Analysis Framework Latest release Download What Droidefense is Droidefense originally named atom: a nalysis t hrough o bservation m achine is the codename for android apps/malware analysis/reversing tool. It was built focused on security issues and trick...

powershell-reverse-tcp

PowerShell 反向 TCP 用于与远程主机通信的 PowerShell 脚本。 远程主机将完全控制客户端及所有底层系统命令。 基于以下方式的 Shell： Invoke-Expression PowerShell 命令 此处, 进程管道 此处. 已在 Windows 10 企业版操作系统（64 位）上的 PowerShell v5.1.19041.2673 中测试。 仅供教育目的。希望对你有所帮助！ 此仓库已开始出现已知签名，我没有时间每次都上传新脚本，因此你应该自行混淆这些脚本。 未来计划： 基于进程管道的更多 Shell，并进一步优化它们。 目录 如何运行 混淆...

pipe-intercept

pipe-intercept Intercepta la comunicación de Windows Named Pipes mediante Burp o herramientas de proxy HTTP similares Los Named Pipes son muy populares para la comunicación entre procesos en Windows. Se utilizan en muchas aplicaciones, incluida la llamada a procedimiento remoto RPC de Windows. El...

CVE-2019-19470-RedTeamRD

CVE-2019-19470-RedTeamRD 此仓库包含用于复现由CODEWHITE发现的CVE-2019-19470漏洞利用的代码和说明。这里提供了我在HackTheBox meetup上使用的示例源代码，用以解释我学习并创建此漏洞利用的过程。 Named Pipe Client and Server Example 1 Named Pipe Client and Server Example 2 Descompilación Example Comandos de WinDbg Código para modificación del PEB Exploit -...

CVE-2022-25365

CVE-2022-25365 Docker Desktop for Windows 中的权限提升漏洞 参考: https://www.cyberark.com/resources/threat-research-blog/breaking-docker-named-pipes-systematically-docker-desktop-privilege-escalation-part-1 文件列表 poc.py 由 followboy1999 编写 createsymlink.exe 由 James Forshaw 编写 junction64.exe 由 Mark Russinovic...

pipe_finder

Pipe Finder 1.0 在SMB协议中自动搜索可用管道名称的脚本 截图 依赖要求 metasploit-framework wget locate pipeauditv2.rb 模块 https://github.com/peterpt/pipeauditorfb - 将在首次运行时安装 安装依赖 apt-get install metasploit-framework wget locate && updatedb updatedb 仅用于缓存 "locate" 搜索数据库，以便获取 metasploit-framework 目录 运行方式 git clone...

DFShell

root@kitploit: ██████╗ ███████╗███████╗██╗ ██╗███████╗██╗ ██╗ ██╔══██╗██╔════╝██╔════╝██║ ██║██╔════╝██║ ██║ ██║ ██║█████╗ ███████╗███████║█████╗ ██║ ██║ ██║ ██║██╔══╝ ╚════██║██╔══██║██╔══╝ ██║ ██║ ██████╔╝██║ ███████║██║ ██║███████╗███████╗███████╗ ╚═════╝ ╚═╝ ╚══════╝╚═╝...

Windows-Kernel-Exploitation

1. Explotación de Desbordamiento del Non-Paged Pool con Named Pipes Técnicas basadas en named pipes para la explotación de desbordamientos de pool, demostradas en CVE-2020-17087 y un desbordamiento off-by-one 2. Abuso de Metadatos del Asignador VS del Segment Heap Técnicas para convertir una...

SAP-memory-pipes-desynchronization-vulnerability-MPI-CVE-2022-22536

SAP-memory-pipes-desynchronization-vulnerability-MPI-CVE-2022-22536 该漏洞涉及什么？ SAP NetWeaver Application Server ABAP、SAP NetWeaver Application Server Java、ABAP Platform、SAP Content Server 7.53 以及 SAP Web Dispatcher 存在请求走私和请求拼接漏洞。未经身份验证的攻击者可以在受害者的请求前附加任意数据。这样一来，攻击者可以冒充受害者执行函数，或毒化中间 Web...

EUVD-2026-67687

filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server...

CVE-2026-82235

filebrowser through 2.63.23 fails to validate named pipes in its directory archive and public download handlers. This causes blocking open syscalls that pin server goroutines and exhaust connection resources, resulting in a denial of service . Both authenticated users and anonymous visitors with ...

CVE-2026-82235 filebrowser through 2.63.23 Denial of Service via named pipes

filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server...

CVE-2026-82235 filebrowser through 2.63.23 Denial of Service via named pipes

filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server...

Windows-Non-Paged-Pool-Overflow-Exploitation

Índice Índice Introdução Introdução a Named Pipes Exploração Espalhamento do pool não paginado Divulgação de memória/Leitura arbitrária Controle completo sobre os dados de transbordo Controle limitado sobre os dados de transbordo Escrita arbitrária Liberação arbitrária de objetos...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: can: mcbausb: properly checking the endpoint type Syzbot reported a warning in usbsubmiturb, which is caused by an incorrect endpoint type. We should check that the endpoint actually exists to prevent this warning. Pipes found ar...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: “pipe: wakeup wrwait after setting maxusage” The commit c73be61cede5 “pipe: Add general notification queue support” introduced a regression that could cause pipes with resized sizes to become locked under certain conditions. See...

CVE-2026-14478

A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated IPC messages into named pipes, modify pipe permissions or ownership, and potentially impact confidentiality, integrity, and availability...