FakeImageExploiter

FakeImageExploiter v1.4 - 后门图像.jpg.ps1 代号: 蜕变 版本发布: v1.4 稳定版 作者: pedro ubuntu r00t-3xp10it 支持发行版: Linux Ubuntu, Kali, Mint, Parrot OS 可疑Shell活动 SSA RedTeam 开发 @2017 法律免责声明: 作者不对该工具的任何不良使用负责，请记住，未经事先同意攻击目标是非法的，并受到法律制裁。 描述: 该模块取一张现有的 image.jpg 和一个 payload.ps1（用户输入），构建一个新的载荷 agent.jpg.exe， 一旦执行，将触发从...

DNS-Shell

DNS-shell DNS-Shell 是一个基于 DNS 通道的交互式 Shell。服务器基于 Python，可以在任何安装了 Python 的操作系统上运行，payload 是一个编码后的 PowerShell 命令。 了解 DNS-Shell 当服务器脚本被调用时生成 Payload，它简单地利用 nslookup 执行查询并向服务器查询新命令，服务器随后监听 53 端口等待传入通信。一旦 payload 在目标机器上执行，服务器将生成一个交互式 Shell。 一旦通道建立，payload 将持续向服务器查询命令。如果输入了新命令，它将执行该命令并将结果返回给服务器。 使用...

chalumeau

Chalumeau Chalumeau 是一款基于 PowerShell 和 Python 的自动化、可扩展且可定制的凭据窃取工具。 主要功能 编写自己的 Payload 内存中执行 提取密码列表 仪表板报告 / Web 界面 解析 Mimikatz 转储票据 截图 已知问题 解析 Mimikatz dcsync（正在修复） 绕过杀毒软件和 EDR，您需要维护自己的 Payload 待办事项 加密通信 自动横向移动 自动密码喷洒 自动哈希破解 使用方法 git clone https://github.com/cyberstruggle/chalumeau.git cd chalumea...

Brutal

现在 Teensy 可以用于渗透测试 Teensy 就像橡胶鸭 Rubber Ducky，为什么我选择 Teensy？因为对我来说价格非常便宜。它在无需人为键盘交互（HID 攻击）的情况下执行目标机器上的脚本极为有用。当你插入设备时，它会被检测为键盘，利用微处理器和板载闪存存储，你可以向目标机器发送非常快速的按键序列，并完全攻破它，无论自动运行是否开启。我在安全测试中使用它来运行侦察或枚举脚本、执行反向 shell、利用本地 DLL 劫持/提权漏洞，以及获取所有密码。 现在我正在开发一个新工具，名字叫 Brutal。 Brutal Brutal 是一个工具包，用于快速创建各种...

eaphammer

by Gabriel Ryan s0lst1c3 Current release: v1.14.1 Supports Python 3.9+. Overview EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks. It is designed to be used in full scope wireless assessments and red team engagements. As such, focus is placed on...

fudshell

fudshell 一款高效的脚本，用于生成红队所需的FUD持久反向Shell。请勿将生成的载荷上传至VirusTotal 警告： 请勿将任何载荷上传至VirusTotal。如果被检测到，请告知我， 我会更新载荷。 如果需要Cobalt Strike规避方案，请通过Telegram联系我：@R0ot1337 使用方法： 1. 输入LHOST（你的IP地址） 2. 输入LPORT（你的端口） 3. 生成PowerShell载荷后。 4. 使用netcat监听（nc -lvnp 你在LPORT中指定的端口） 安装： a git clone...

CVE-2025-55319-PoC

Reference: CVE-2025-55319 针对 HTB "Checkpoint" 挑战的 VS Code .vsix 扩展概念验证。 安装后，扩展自动激活并产生一个隐藏的 PowerShell 反向 shell 回连到攻击者。 ⚠️ 仅限授权使用。 这是一个 CTF/实验室环境产物。仅可部署在你拥有或明确授权测试（例如 HTB 目标机）的机器上。 工作原理 extension/package.json — 扩展清单。"activationEvents": "" 使它在 VS Code 加载时即刻运行，无需用户交互。 extension/extension.js — 在...

CVE-2026-50522 — Updated!

CVE-2026-50522 Microsoft SharePoint CVE-2026-50522 payloads and analysis. HTTP requests request| src| user-agent| encoding| unique id| payload ---|---|---|---|---|--- 816978882| 45.63.58.216| Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36| '|...

MAL-2026-5790 Malicious code in ldpbootstrap-jquery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcab02ae44d1604b6fa9e80156a8c5882f7a4809470ff59eb6d14db4bf28f91f ldpbootstrap-jquery ships and executes an obfuscated Windows PowerShell payload as part of its documented usage. The package contains...

Malicious code in mailconfirmer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfb184ffa15fd011b84658a6b5cd68582e78827258a8373f0da1ef34248bfb09 The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log demo messages. The real...

Fileless Multi-Stage Remcos RAT: From Phishing to Memory-Resident Execution

Fileless Multi-Stage Remcos RAT: From Phishing to Memory-Resident Execution By Madhini Muralidharan · March 11, 2026 Traditional malware campaigns rely heavily on dropping executable files to disk—artifacts that defenders can scan, quarantine, and analyze with signature-based security tools. Mode...

Hackers Exploit Metro4Shell RCE Flaw in React Native CLI npm Package

Threat actors have been observed exploiting a critical security flaw impacting the Metro Development Server in the popular "@react-native-community/cli" npm package. Cybersecurity company VulnChecksaid it first observed exploitation of CVE-2025-11953 aka Metro4Shell on December 21, 2025. With a...

WMI Event Subscription Event Log Persistence

This Metasploit module will create a permanent WMI event subscription to achieve file-less persistence using an event filter that will query the event log for an EVENTIDTRIGGER default: failed logon request id 4625 that also contains a specified USERNAMETRIGGER note: failed logon auditing must be...

Exploit for CVE-2025-55182

React2Shell Scanner High Fidelity Detection & Exploitation To...

Exploit for CVE-2010-1240

CVE-2010-1240 PDF Launch Action Research Tool !Pythonhttps...

Researchers Find VS Code Flaw Allowing Attackers to Republish Deleted Extensions Under Same Names

Cybersecurity researchers have discovered a loophole in the Visual Studio Code Marketplace that allows threat actors to reuse names of previously removed extensions. Software supply chain security outfit ReversingLabs said it made the discovery after it identified a malicious extension named...

📄 RustFly 2.0.0 Remote Code Execution

RustFly version 2.0.0 contains a critical vulnerability in its remote input processing layer that allows unauthenticated attackers to achieve remote code execution. RustFly v2.0.0- Remote Code Execution RCE Exploit Title: RustFly v2.0.0- Remote Code Execution RCE Date: 2025-05-29 Exploit Author:...

Hackers Exploiting Remote Desktop Software Flaws to Deploy PlugX Malware

Security vulnerabilities in remote desktop programs such as Sunlogin and AweSun are being exploited by threat actors to deploy the PlugX malware. AhnLab Security Emergency Response Center ASEC, in a new analysis, said it marks the continued abuse of the flaws to deliver a variety of payloads on...

New Russian-Backed Gamaredon's Spyware Variants Targeting Ukrainian Authorities

The State Cyber Protection Centre SCPC of Ukraine has called out the Russian state-sponsored threat actor known as Gamaredon for its targeted cyber attacks on public authorities and critical information infrastructure in the country. The advanced persistent threat, also known as Actinium,...

Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)

Execute an x86 payload from a command via PowerShell. Listen for a connection Module Options msf use payload/cmd/windows/powershell/patchupmeterpreter/bindtcprc4 msf payloadbindtcprc4 show actions ...actions... msf payloadbindtcprc4 set ACTION msf payloadbindtcprc4 show options ...show and set...